24070 lines
1,012 KiB
JSON
24070 lines
1,012 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--56095160-7848-4ce6-b0d4-4d2b950d210b",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:06:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:06:20.000Z",
|
||
|
|
"name": "CthulhuSPRL.be",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--56095160-7848-4ce6-b0d4-4d2b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:06:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:06:20.000Z",
|
||
|
|
"name": "OSINT Microsoft Word Intruder gets down to business: Operation Pony Express by Sophos",
|
||
|
|
"published": "2015-09-29T07:06:26Z",
|
||
|
|
"object_refs": [
|
||
|
|
"x-misp-attribute--56095173-f20c-4e2c-b4ae-e631950d210b",
|
||
|
|
"observed-data--5609518e-fc78-4dc0-9ba6-e631950d210b",
|
||
|
|
"url--5609518e-fc78-4dc0-9ba6-e631950d210b",
|
||
|
|
"observed-data--5609518e-06b8-495a-b184-e631950d210b",
|
||
|
|
"url--5609518e-06b8-495a-b184-e631950d210b",
|
||
|
|
"indicator--56095217-3874-459f-92e6-47ba950d210b",
|
||
|
|
"indicator--56095223-2388-46fb-86da-4ce7950d210b",
|
||
|
|
"indicator--56095223-a2ec-4926-bcb8-4742950d210b",
|
||
|
|
"indicator--56095224-77f8-4df8-aa36-43aa950d210b",
|
||
|
|
"indicator--56095224-24fc-4b8a-ae07-4d2a950d210b",
|
||
|
|
"indicator--56095231-1ce8-429e-9352-4c72950d210b",
|
||
|
|
"indicator--56095232-58bc-413e-be09-46c2950d210b",
|
||
|
|
"indicator--56095232-8e68-42da-9bbd-418f950d210b",
|
||
|
|
"indicator--5609524e-9de8-49b1-8643-4f96950d210b",
|
||
|
|
"indicator--5609524e-928c-40d0-b2e2-4a58950d210b",
|
||
|
|
"indicator--5609524f-2bb4-4bf3-ba46-4488950d210b",
|
||
|
|
"indicator--5609525c-fb58-4523-ac2c-e621950d210b",
|
||
|
|
"indicator--5609525c-3ee8-4eea-a0cf-e621950d210b",
|
||
|
|
"indicator--5609525c-85f0-4cb3-a61a-e621950d210b",
|
||
|
|
"indicator--5609525d-f044-468d-ac2a-e621950d210b",
|
||
|
|
"indicator--5609525d-e6bc-4e1c-bf7d-e621950d210b",
|
||
|
|
"indicator--5609525d-04dc-4d67-b803-e621950d210b",
|
||
|
|
"indicator--5609525e-81b0-44db-9383-e621950d210b",
|
||
|
|
"indicator--5609525e-2974-4dfc-834a-e621950d210b",
|
||
|
|
"indicator--5609525f-7d20-42e7-ba97-e621950d210b",
|
||
|
|
"indicator--5609525f-6dd4-4da7-ad77-e621950d210b",
|
||
|
|
"indicator--5609525f-8cb0-45c5-8c32-e621950d210b",
|
||
|
|
"indicator--56095260-7b34-4fc8-ac0c-e621950d210b",
|
||
|
|
"indicator--56095260-7d20-464f-8c95-e621950d210b",
|
||
|
|
"indicator--56095260-cfdc-4ecc-93fe-e621950d210b",
|
||
|
|
"indicator--56095261-d640-4df7-baaf-e621950d210b",
|
||
|
|
"indicator--56095261-cfcc-43c3-a8cf-e621950d210b",
|
||
|
|
"indicator--56095261-fcc0-49be-bbbe-e621950d210b",
|
||
|
|
"indicator--56095262-1f0c-40dd-988b-e621950d210b",
|
||
|
|
"indicator--56095262-aff4-4fdd-b10a-e621950d210b",
|
||
|
|
"indicator--56095272-021c-48e5-846f-4288950d210b",
|
||
|
|
"indicator--56095273-4398-403b-9d68-421b950d210b",
|
||
|
|
"indicator--56095273-b440-43c4-92fd-4e12950d210b",
|
||
|
|
"indicator--56095274-1a18-4265-be55-4460950d210b",
|
||
|
|
"indicator--56095274-7060-45db-af09-44d3950d210b",
|
||
|
|
"indicator--56095274-f734-4cf1-9013-4151950d210b",
|
||
|
|
"indicator--56095275-c440-48a7-9f67-46c3950d210b",
|
||
|
|
"indicator--56095275-8c2c-495d-90b6-4f9f950d210b",
|
||
|
|
"indicator--56095276-d39c-4be7-8ba5-441e950d210b",
|
||
|
|
"indicator--56095276-8ee4-4f45-8055-44f0950d210b",
|
||
|
|
"indicator--56095277-8064-4174-b399-4b22950d210b",
|
||
|
|
"indicator--56095277-cd70-4b44-8139-4327950d210b",
|
||
|
|
"indicator--56095277-2508-42b6-9470-4e23950d210b",
|
||
|
|
"indicator--56095278-2140-44fb-9489-4531950d210b",
|
||
|
|
"indicator--56095278-3b7c-4220-8076-40ee950d210b",
|
||
|
|
"indicator--56095279-5268-47c0-9f0a-4913950d210b",
|
||
|
|
"indicator--56095279-c944-4942-9122-457c950d210b",
|
||
|
|
"indicator--5609527a-a5bc-4bf9-a9d8-4d20950d210b",
|
||
|
|
"indicator--5609527a-8258-4e75-aafa-4d93950d210b",
|
||
|
|
"indicator--5609527a-a108-47ab-81d3-452d950d210b",
|
||
|
|
"indicator--5609527b-fbd0-4c3a-868b-4c26950d210b",
|
||
|
|
"indicator--5609527b-0fa4-4f95-8ed0-43dd950d210b",
|
||
|
|
"indicator--5609527c-c410-4a1a-8bc6-4ee5950d210b",
|
||
|
|
"indicator--5609527c-ca28-4d7c-b60f-4c07950d210b",
|
||
|
|
"indicator--5609527c-0db8-4464-ad95-4aa4950d210b",
|
||
|
|
"indicator--5609527d-f7ec-4365-bb4c-4115950d210b",
|
||
|
|
"indicator--5609527d-1f88-4b23-9f08-4e75950d210b",
|
||
|
|
"indicator--5609527e-bb20-4564-873c-4a1c950d210b",
|
||
|
|
"indicator--5609527e-4808-4ce9-847a-410a950d210b",
|
||
|
|
"indicator--5609527f-5d38-4b60-b56c-4b3b950d210b",
|
||
|
|
"indicator--5609527f-8dd4-4718-a463-4eab950d210b",
|
||
|
|
"indicator--5609527f-5f10-4a55-a06b-433f950d210b",
|
||
|
|
"indicator--56095280-e838-409f-8a57-4b06950d210b",
|
||
|
|
"indicator--56095280-10b4-4aad-b94f-41fe950d210b",
|
||
|
|
"indicator--56095281-1488-48c9-80ed-4e14950d210b",
|
||
|
|
"indicator--56095281-6a30-4c6c-bc01-47f0950d210b",
|
||
|
|
"indicator--56095282-cc28-46dc-9167-4d7f950d210b",
|
||
|
|
"indicator--56095282-88e0-4fd4-8046-4ee4950d210b",
|
||
|
|
"indicator--56095282-170c-459c-9492-4e0a950d210b",
|
||
|
|
"indicator--56095283-c580-46f7-a77a-418b950d210b",
|
||
|
|
"indicator--56095283-b478-410a-b842-4aa6950d210b",
|
||
|
|
"indicator--56095284-1454-4c4b-82c3-4a9a950d210b",
|
||
|
|
"indicator--56095284-25a4-4d7c-b235-4c97950d210b",
|
||
|
|
"indicator--56095284-193c-4f15-8767-4e33950d210b",
|
||
|
|
"indicator--56095285-faa4-4dab-95dd-4030950d210b",
|
||
|
|
"indicator--56095285-e424-47bc-879b-4d2a950d210b",
|
||
|
|
"indicator--56095286-ad44-4646-a1d4-467e950d210b",
|
||
|
|
"indicator--56095286-a708-46c1-bf0a-4057950d210b",
|
||
|
|
"indicator--56095287-114c-4abd-b6ab-4ccf950d210b",
|
||
|
|
"indicator--56095287-7764-4ea9-852a-46f0950d210b",
|
||
|
|
"indicator--56095287-1b28-4575-9a7f-486a950d210b",
|
||
|
|
"indicator--56095288-916c-4a18-a100-42d0950d210b",
|
||
|
|
"indicator--56095288-7dac-4d4f-82cd-4402950d210b",
|
||
|
|
"indicator--560952b7-0c7c-4e6e-bb9e-4ac0950d210b",
|
||
|
|
"indicator--560952b8-b3f0-451c-886d-4e79950d210b",
|
||
|
|
"indicator--560952b8-b5b8-4f47-b137-495e950d210b",
|
||
|
|
"indicator--560952c4-12e8-437c-9e47-4810950d210b",
|
||
|
|
"indicator--560952cf-a318-4c29-ad46-e621950d210b",
|
||
|
|
"indicator--560952cf-94cc-48e1-be98-e621950d210b",
|
||
|
|
"indicator--560952db-5448-4022-b442-4a0e950d210b",
|
||
|
|
"indicator--560952dc-12e0-427d-8c05-4ff5950d210b",
|
||
|
|
"indicator--560952dc-3d74-4bbe-87ea-4d4a950d210b",
|
||
|
|
"indicator--560952e6-2c94-43dc-a0e4-4f18950d210b",
|
||
|
|
"indicator--560952e6-4be8-4087-b286-4f18950d210b",
|
||
|
|
"indicator--560952e7-866c-431f-a95f-48a9950d210b",
|
||
|
|
"indicator--560952f2-9328-4511-b9fa-4d4e950d210b",
|
||
|
|
"indicator--560952f3-d320-4688-9c81-4a85950d210b",
|
||
|
|
"indicator--560952f3-513c-443c-a882-4482950d210b",
|
||
|
|
"indicator--56095300-0458-4dc4-973c-468e950d210b",
|
||
|
|
"indicator--5609530d-013c-486f-9861-4587950d210b",
|
||
|
|
"indicator--5609530d-b240-401f-bd12-4ccd950d210b",
|
||
|
|
"indicator--5609530d-8894-4ff1-8ca6-44ad950d210b",
|
||
|
|
"indicator--5609530e-ceb8-49ed-94a7-4897950d210b",
|
||
|
|
"indicator--5609531c-69f4-4f1d-8e65-e0ac950d210b",
|
||
|
|
"indicator--5609531c-d024-4dd9-92da-e0ac950d210b",
|
||
|
|
"indicator--5609531d-0e90-416e-9c22-e0ac950d210b",
|
||
|
|
"indicator--5609531d-dcdc-4bee-b6a2-e0ac950d210b",
|
||
|
|
"indicator--56095329-4fcc-4561-ba1c-e0ac950d210b",
|
||
|
|
"indicator--56095329-6110-4df1-8e16-e0ac950d210b",
|
||
|
|
"indicator--5609532a-a93c-4f07-97b3-e0ac950d210b",
|
||
|
|
"indicator--5609532a-6b84-4ea2-95a2-e0ac950d210b",
|
||
|
|
"indicator--5609532b-9dc0-436c-967a-e0ac950d210b",
|
||
|
|
"indicator--5609532b-b160-44e9-8659-e0ac950d210b",
|
||
|
|
"indicator--5609532c-13c0-4401-94af-e0ac950d210b",
|
||
|
|
"indicator--5609532c-ebbc-47e9-b15c-e0ac950d210b",
|
||
|
|
"indicator--5609532c-6058-4612-a02e-e0ac950d210b",
|
||
|
|
"indicator--5609532d-d304-424c-b1b2-e0ac950d210b",
|
||
|
|
"indicator--5609532d-5308-494b-a517-e0ac950d210b",
|
||
|
|
"indicator--5609532e-a0a4-4339-ba57-e0ac950d210b",
|
||
|
|
"indicator--5609532e-57cc-4276-a8c0-e0ac950d210b",
|
||
|
|
"indicator--5609532e-bcbc-4ee9-82f8-e0ac950d210b",
|
||
|
|
"indicator--5609532f-7410-4e71-9223-e0ac950d210b",
|
||
|
|
"indicator--5609532f-1c30-4b4f-8637-e0ac950d210b",
|
||
|
|
"indicator--5609533b-f6c4-42ed-92b2-e0ac950d210b",
|
||
|
|
"indicator--5609533b-81b0-4f55-80ab-e0ac950d210b",
|
||
|
|
"indicator--56095345-069c-48b4-a23a-e0ac950d210b",
|
||
|
|
"indicator--56095346-1174-4cdc-ad5c-e0ac950d210b",
|
||
|
|
"indicator--56095346-c6b8-44d2-8fcb-e0ac950d210b",
|
||
|
|
"indicator--56095350-80ac-4c07-857d-e0ac950d210b",
|
||
|
|
"indicator--56095350-ea64-479d-9685-e0ac950d210b",
|
||
|
|
"indicator--56095351-02ec-4ba7-abe4-e0ac950d210b",
|
||
|
|
"indicator--56095351-81c4-4c70-adbc-e0ac950d210b",
|
||
|
|
"indicator--56095352-a720-4896-ba6d-e0ac950d210b",
|
||
|
|
"indicator--56095352-3e78-43cb-9445-e0ac950d210b",
|
||
|
|
"indicator--56095363-9ea4-41a6-8f74-43dd950d210b",
|
||
|
|
"indicator--56095364-1f30-4c62-bf67-47f0950d210b",
|
||
|
|
"indicator--56095364-5098-4182-bed0-4b76950d210b",
|
||
|
|
"indicator--56095364-98c0-4b91-8cbf-4a66950d210b",
|
||
|
|
"indicator--56095365-f68c-486e-9a02-49b4950d210b",
|
||
|
|
"indicator--56095365-589c-4fac-8dbe-4655950d210b",
|
||
|
|
"indicator--56095365-1eac-4537-8cab-4fc6950d210b",
|
||
|
|
"indicator--56095366-b250-47a6-86a8-4d32950d210b",
|
||
|
|
"indicator--56095366-3014-4975-b747-48a9950d210b",
|
||
|
|
"indicator--56095386-396c-4502-8b32-4508950d210b",
|
||
|
|
"indicator--56095387-e1b0-4cd3-8827-4062950d210b",
|
||
|
|
"indicator--56095393-0e04-4ea4-8671-4b11950d210b",
|
||
|
|
"indicator--560953a0-a1e8-4e47-9f08-4c3e950d210b",
|
||
|
|
"indicator--560953aa-fbc8-4abd-b5b2-475b950d210b",
|
||
|
|
"indicator--560953b3-82b8-4cc8-b623-4007950d210b",
|
||
|
|
"indicator--560953c1-6ed8-4d18-b9c0-4ea6950d210b",
|
||
|
|
"indicator--560953c1-a8d4-4cea-a044-4146950d210b",
|
||
|
|
"indicator--560953c1-d018-4d73-8aa1-4e70950d210b",
|
||
|
|
"indicator--560953d0-763c-4161-868a-4af4950d210b",
|
||
|
|
"indicator--560953d0-63b4-4f0b-bcaf-4e29950d210b",
|
||
|
|
"indicator--560953e4-92d0-43a2-8ca6-e0ac950d210b",
|
||
|
|
"indicator--560953f2-0604-4d52-9a1a-48d5950d210b",
|
||
|
|
"indicator--560953f3-fb78-4a9d-9921-4c33950d210b",
|
||
|
|
"indicator--560953fe-5f34-4805-bf80-4990950d210b",
|
||
|
|
"indicator--56095407-7e5c-4e8a-8843-475d950d210b",
|
||
|
|
"indicator--56095407-cba4-4d2d-be65-48da950d210b",
|
||
|
|
"indicator--56095413-315c-474f-85bd-473e950d210b",
|
||
|
|
"indicator--56095413-0dbc-4e6c-b7a8-4b3b950d210b",
|
||
|
|
"indicator--56095414-84c8-484f-9518-4b5b950d210b",
|
||
|
|
"indicator--56095426-dcd4-4cf1-aea8-4593950d210b",
|
||
|
|
"indicator--56095427-6088-44f7-8280-44f3950d210b",
|
||
|
|
"indicator--56095427-6a74-4ec7-b662-41a3950d210b",
|
||
|
|
"indicator--56095432-40a8-4149-ab3a-4956950d210b",
|
||
|
|
"indicator--56095432-7df4-4f39-8370-4e60950d210b",
|
||
|
|
"indicator--56095433-ba08-4371-ad12-45c7950d210b",
|
||
|
|
"indicator--56095433-ad44-4b4e-b30a-4008950d210b",
|
||
|
|
"indicator--5609543e-1d70-4d79-bcc3-40e4950d210b",
|
||
|
|
"indicator--5609543f-87b0-4f63-9ce5-415d950d210b",
|
||
|
|
"indicator--56095449-4184-4550-818f-4532950d210b",
|
||
|
|
"indicator--56095449-b190-48f4-bf6e-4c46950d210b",
|
||
|
|
"indicator--56095458-c420-4968-a0d1-e0ac950d210b",
|
||
|
|
"indicator--56095463-af20-48b3-9212-e0ac950d210b",
|
||
|
|
"indicator--56095463-9470-4c74-bb23-e0ac950d210b",
|
||
|
|
"indicator--56095464-bc18-4ac0-bdda-e0ac950d210b",
|
||
|
|
"indicator--56095464-f26c-4db0-8248-e0ac950d210b",
|
||
|
|
"indicator--56095472-c0a0-4618-838a-42da950d210b",
|
||
|
|
"indicator--56095472-40e8-410a-b439-4ab3950d210b",
|
||
|
|
"indicator--56095472-1a9c-42ee-a2af-42a0950d210b",
|
||
|
|
"indicator--56095473-6254-46b2-95fe-46a9950d210b",
|
||
|
|
"indicator--56095473-c424-4ecb-8594-417c950d210b",
|
||
|
|
"indicator--56095474-fa68-42c4-9d51-45e9950d210b",
|
||
|
|
"indicator--56095474-2480-423f-aa50-4668950d210b",
|
||
|
|
"indicator--56095474-efe8-4362-a412-43f3950d210b",
|
||
|
|
"indicator--56095475-1438-40a8-b6c2-480f950d210b",
|
||
|
|
"indicator--56095475-2dbc-4581-9e54-4fae950d210b",
|
||
|
|
"indicator--56095475-8238-41c7-94b1-4b35950d210b",
|
||
|
|
"indicator--56095476-6830-4093-b2a1-4bdf950d210b",
|
||
|
|
"indicator--56095476-3404-4605-85d0-40a3950d210b",
|
||
|
|
"indicator--56095476-f74c-4032-b53b-4aaa950d210b",
|
||
|
|
"indicator--56095477-a4a0-4bf7-951e-4e9d950d210b",
|
||
|
|
"indicator--56095477-6b40-4887-987c-4d4c950d210b",
|
||
|
|
"indicator--56095477-6e2c-416e-a5aa-4bbc950d210b",
|
||
|
|
"indicator--56095478-58f8-4827-9985-4124950d210b",
|
||
|
|
"indicator--56095478-afe0-47aa-8db7-4fda950d210b",
|
||
|
|
"indicator--56095478-0ee8-4bb1-a0d8-4361950d210b",
|
||
|
|
"indicator--56095479-007c-4fbc-805d-48fe950d210b",
|
||
|
|
"indicator--56095479-918c-4245-b15c-4aca950d210b",
|
||
|
|
"indicator--5609547a-d8d0-447b-9d6b-46a8950d210b",
|
||
|
|
"indicator--5609547a-4470-4d70-88a7-46b3950d210b",
|
||
|
|
"indicator--5609547a-89fc-4439-85c8-4735950d210b",
|
||
|
|
"indicator--5609547b-4f48-4d27-b1f9-4e1a950d210b",
|
||
|
|
"indicator--5609547b-69a0-4b5f-9dcf-4405950d210b",
|
||
|
|
"indicator--5609547b-6de0-4d35-83fe-46ba950d210b",
|
||
|
|
"indicator--5609547c-8b2c-438b-a74c-42e8950d210b",
|
||
|
|
"indicator--5609547c-3290-4bd6-a406-46ae950d210b",
|
||
|
|
"indicator--5609547c-8bd4-4ee9-b098-4f04950d210b",
|
||
|
|
"indicator--5609547d-f370-4759-a0cb-4733950d210b",
|
||
|
|
"indicator--5609547d-6600-4ff1-8ad2-4160950d210b",
|
||
|
|
"indicator--5609547d-0c64-4693-82bf-4f40950d210b",
|
||
|
|
"indicator--5609547e-aa94-448f-83a8-40e1950d210b",
|
||
|
|
"indicator--5609547e-73f8-436f-b7db-4821950d210b",
|
||
|
|
"indicator--5609547e-4c14-47e1-bf70-49b6950d210b",
|
||
|
|
"indicator--5609547f-bccc-4d1d-adff-4f7e950d210b",
|
||
|
|
"indicator--5609547f-8200-4e8b-9ff9-404b950d210b",
|
||
|
|
"indicator--5609547f-7ea4-40b1-ab83-42a5950d210b",
|
||
|
|
"indicator--56095480-0b70-426f-849e-4460950d210b",
|
||
|
|
"indicator--56095480-dd30-44cd-92bc-47e9950d210b",
|
||
|
|
"indicator--56095480-c7ec-4937-8214-48c7950d210b",
|
||
|
|
"indicator--56095481-02f4-4968-b23d-4ef9950d210b",
|
||
|
|
"indicator--56095481-beac-43b8-ab9c-49c8950d210b",
|
||
|
|
"indicator--56095482-ecc4-4e21-9e56-471b950d210b",
|
||
|
|
"indicator--56095482-46e0-42f4-bd67-4daa950d210b",
|
||
|
|
"indicator--56095482-de28-42e4-a34d-4605950d210b",
|
||
|
|
"indicator--56095483-fc18-4e8f-8713-4ae3950d210b",
|
||
|
|
"indicator--56095483-ec4c-4945-8ee1-4a53950d210b",
|
||
|
|
"indicator--56095483-87bc-4889-a286-4337950d210b",
|
||
|
|
"indicator--56095484-02b8-47a7-a9c8-494b950d210b",
|
||
|
|
"indicator--56095484-79b8-4616-901d-42a4950d210b",
|
||
|
|
"indicator--56095484-1750-4ac1-b8d4-4447950d210b",
|
||
|
|
"indicator--56095485-f158-41ed-8f52-4f5c950d210b",
|
||
|
|
"indicator--56095485-b46c-44b9-a2fa-4f51950d210b",
|
||
|
|
"indicator--56095485-b988-4918-aa05-4d7b950d210b",
|
||
|
|
"indicator--560955f5-9244-4807-8d18-414c950d210b",
|
||
|
|
"indicator--560955f5-ce24-4374-bc31-4a2c950d210b",
|
||
|
|
"indicator--560955f6-0e2c-4551-ad43-4cd3950d210b",
|
||
|
|
"indicator--560955f6-59d4-460d-9334-473d950d210b",
|
||
|
|
"indicator--56095689-af1c-4442-a640-498d950d210b",
|
||
|
|
"indicator--560a3740-f244-4679-983f-e475950d210b",
|
||
|
|
"indicator--560a3741-19a8-442c-9a82-e475950d210b",
|
||
|
|
"observed-data--560a3741-8570-4787-97c1-e475950d210b",
|
||
|
|
"url--560a3741-8570-4787-97c1-e475950d210b",
|
||
|
|
"indicator--560a3742-4ed0-4757-903b-e475950d210b",
|
||
|
|
"indicator--560a3742-6a20-4db5-8ba2-e475950d210b",
|
||
|
|
"observed-data--560a3742-4944-49f7-b8d7-e475950d210b",
|
||
|
|
"url--560a3742-4944-49f7-b8d7-e475950d210b",
|
||
|
|
"indicator--560a3743-aa30-4b16-abde-e475950d210b",
|
||
|
|
"indicator--560a3743-f574-4469-8146-e475950d210b",
|
||
|
|
"observed-data--560a3743-0de8-4570-aafa-e475950d210b",
|
||
|
|
"url--560a3743-0de8-4570-aafa-e475950d210b",
|
||
|
|
"indicator--560a3744-dd48-42c4-b5f8-e475950d210b",
|
||
|
|
"indicator--560a3744-e8f0-42b0-8904-e475950d210b",
|
||
|
|
"observed-data--560a3745-c61c-499c-adf1-e475950d210b",
|
||
|
|
"url--560a3745-c61c-499c-adf1-e475950d210b",
|
||
|
|
"indicator--560a3745-68a8-4eac-b516-e475950d210b",
|
||
|
|
"indicator--560a3745-e2d4-439e-9114-e475950d210b",
|
||
|
|
"observed-data--560a3746-7194-4e35-8ac4-e475950d210b",
|
||
|
|
"url--560a3746-7194-4e35-8ac4-e475950d210b",
|
||
|
|
"indicator--560a3746-1db4-4037-9f21-e475950d210b",
|
||
|
|
"indicator--560a3746-09c0-46cd-ac56-e475950d210b",
|
||
|
|
"observed-data--560a3747-d270-48a7-a20f-e475950d210b",
|
||
|
|
"url--560a3747-d270-48a7-a20f-e475950d210b",
|
||
|
|
"indicator--560a3747-6248-4483-a0cb-e475950d210b",
|
||
|
|
"indicator--560a3747-7dfc-408b-8e4c-e475950d210b",
|
||
|
|
"observed-data--560a3748-c2a0-4f17-852d-e475950d210b",
|
||
|
|
"url--560a3748-c2a0-4f17-852d-e475950d210b",
|
||
|
|
"indicator--560a3748-ac34-4769-a090-e475950d210b",
|
||
|
|
"indicator--560a3748-7d48-4672-b71e-e475950d210b",
|
||
|
|
"observed-data--560a3749-c4d8-4904-b36b-e475950d210b",
|
||
|
|
"url--560a3749-c4d8-4904-b36b-e475950d210b",
|
||
|
|
"indicator--560a3749-38dc-444e-a36b-e475950d210b",
|
||
|
|
"indicator--560a3749-9748-4013-a267-e475950d210b",
|
||
|
|
"observed-data--560a374a-f41c-4510-8b69-e475950d210b",
|
||
|
|
"url--560a374a-f41c-4510-8b69-e475950d210b",
|
||
|
|
"indicator--560a374a-dba0-42ae-842b-e475950d210b",
|
||
|
|
"indicator--560a374a-1cb8-4eb4-bc7c-e475950d210b",
|
||
|
|
"observed-data--560a374b-e1b0-45ca-aa57-e475950d210b",
|
||
|
|
"url--560a374b-e1b0-45ca-aa57-e475950d210b",
|
||
|
|
"indicator--560a374b-26a8-4477-b159-e475950d210b",
|
||
|
|
"indicator--560a374b-35e0-4f33-9318-e475950d210b",
|
||
|
|
"observed-data--560a374c-8660-4b00-bb23-e475950d210b",
|
||
|
|
"url--560a374c-8660-4b00-bb23-e475950d210b",
|
||
|
|
"indicator--560a374c-28a8-49da-89ed-e475950d210b",
|
||
|
|
"indicator--560a374d-49f8-4e42-ad20-e475950d210b",
|
||
|
|
"observed-data--560a374d-f51c-4350-9e8d-e475950d210b",
|
||
|
|
"url--560a374d-f51c-4350-9e8d-e475950d210b",
|
||
|
|
"indicator--560a374d-8a10-488c-b3f2-e475950d210b",
|
||
|
|
"indicator--560a374e-f9a0-4ec0-932b-e475950d210b",
|
||
|
|
"observed-data--560a374e-3838-473a-8c94-e475950d210b",
|
||
|
|
"url--560a374e-3838-473a-8c94-e475950d210b",
|
||
|
|
"indicator--560a374e-8618-4a90-89ed-e475950d210b",
|
||
|
|
"indicator--560a374f-4680-488b-9f8b-e475950d210b",
|
||
|
|
"observed-data--560a374f-3798-4140-8e9f-e475950d210b",
|
||
|
|
"url--560a374f-3798-4140-8e9f-e475950d210b",
|
||
|
|
"indicator--560a374f-1e50-4a16-a8dc-e475950d210b",
|
||
|
|
"indicator--560a3750-6380-448b-bee6-e475950d210b",
|
||
|
|
"observed-data--560a3750-0398-4106-92b4-e475950d210b",
|
||
|
|
"url--560a3750-0398-4106-92b4-e475950d210b",
|
||
|
|
"indicator--560a3750-1e7c-4018-ad74-e475950d210b",
|
||
|
|
"indicator--560a3751-9214-4dd8-a01e-e475950d210b",
|
||
|
|
"observed-data--560a3751-a724-4166-a961-e475950d210b",
|
||
|
|
"url--560a3751-a724-4166-a961-e475950d210b",
|
||
|
|
"indicator--560a3751-afd4-442f-b9ea-e475950d210b",
|
||
|
|
"indicator--560a3752-aa24-4e4b-8c35-e475950d210b",
|
||
|
|
"observed-data--560a3752-ac08-4f47-b6b6-e475950d210b",
|
||
|
|
"url--560a3752-ac08-4f47-b6b6-e475950d210b",
|
||
|
|
"indicator--560a3752-39fc-4e81-8cca-e475950d210b",
|
||
|
|
"indicator--560a3753-8eb4-46fb-9c8b-e475950d210b",
|
||
|
|
"observed-data--560a3753-3a60-4bf5-8891-e475950d210b",
|
||
|
|
"url--560a3753-3a60-4bf5-8891-e475950d210b",
|
||
|
|
"indicator--560a3754-6cb4-4906-bf49-e475950d210b",
|
||
|
|
"indicator--560a3754-d928-42b9-8d54-e475950d210b",
|
||
|
|
"observed-data--560a3754-81ac-406c-8d2d-e475950d210b",
|
||
|
|
"url--560a3754-81ac-406c-8d2d-e475950d210b",
|
||
|
|
"indicator--560a3755-dc1c-4ebb-b86d-e475950d210b",
|
||
|
|
"indicator--560a3755-ddc0-48cb-9a0a-e475950d210b",
|
||
|
|
"observed-data--560a3755-708c-4e15-807d-e475950d210b",
|
||
|
|
"url--560a3755-708c-4e15-807d-e475950d210b",
|
||
|
|
"indicator--560a3756-b8d4-45fe-87ba-e475950d210b",
|
||
|
|
"indicator--560a3756-610c-4c77-8135-e475950d210b",
|
||
|
|
"observed-data--560a3756-2d94-4384-b425-e475950d210b",
|
||
|
|
"url--560a3756-2d94-4384-b425-e475950d210b",
|
||
|
|
"indicator--560a3757-5e9c-48af-9079-e475950d210b",
|
||
|
|
"indicator--560a3757-1f14-4679-af8d-e475950d210b",
|
||
|
|
"observed-data--560a3758-a7bc-44be-94ea-e475950d210b",
|
||
|
|
"url--560a3758-a7bc-44be-94ea-e475950d210b",
|
||
|
|
"indicator--560a3758-9e6c-4965-b03e-e475950d210b",
|
||
|
|
"indicator--560a3758-2848-4240-a200-e475950d210b",
|
||
|
|
"observed-data--560a3759-2a90-4837-8d30-e475950d210b",
|
||
|
|
"url--560a3759-2a90-4837-8d30-e475950d210b",
|
||
|
|
"indicator--560a3759-4354-4ec7-adf2-e475950d210b",
|
||
|
|
"indicator--560a3759-7ffc-428e-91ef-e475950d210b",
|
||
|
|
"observed-data--560a375a-15f4-47b1-8f77-e475950d210b",
|
||
|
|
"url--560a375a-15f4-47b1-8f77-e475950d210b",
|
||
|
|
"indicator--560a375a-d8ec-4e12-b4d7-e475950d210b",
|
||
|
|
"indicator--560a375a-99d0-4af0-b92a-e475950d210b",
|
||
|
|
"observed-data--560a375b-78c8-4ffc-8b72-e475950d210b",
|
||
|
|
"url--560a375b-78c8-4ffc-8b72-e475950d210b",
|
||
|
|
"indicator--560a375b-02d4-457c-9d53-e475950d210b",
|
||
|
|
"indicator--560a375b-4730-473f-917b-e475950d210b",
|
||
|
|
"observed-data--560a375c-6230-4d0d-a29d-e475950d210b",
|
||
|
|
"url--560a375c-6230-4d0d-a29d-e475950d210b",
|
||
|
|
"indicator--560a375c-90f0-4444-88c1-e475950d210b",
|
||
|
|
"indicator--560a375c-7fdc-48b0-bcd8-e475950d210b",
|
||
|
|
"observed-data--560a375d-486c-4426-bde9-e475950d210b",
|
||
|
|
"url--560a375d-486c-4426-bde9-e475950d210b",
|
||
|
|
"indicator--560a375d-90d0-4d9d-be60-e475950d210b",
|
||
|
|
"indicator--560a375d-8d18-40c9-98ad-e475950d210b",
|
||
|
|
"observed-data--560a375e-96e8-4d3d-a3cd-e475950d210b",
|
||
|
|
"url--560a375e-96e8-4d3d-a3cd-e475950d210b",
|
||
|
|
"indicator--560a375e-c8e8-4bb5-a21c-e475950d210b",
|
||
|
|
"indicator--560a375e-3208-4279-b03f-e475950d210b",
|
||
|
|
"observed-data--560a375f-d3cc-4ca0-b572-e475950d210b",
|
||
|
|
"url--560a375f-d3cc-4ca0-b572-e475950d210b",
|
||
|
|
"indicator--560a375f-49e4-4084-af2a-e475950d210b",
|
||
|
|
"indicator--560a3760-7d48-44d8-b3e4-e475950d210b",
|
||
|
|
"observed-data--560a3760-af50-4bbc-a2e2-e475950d210b",
|
||
|
|
"url--560a3760-af50-4bbc-a2e2-e475950d210b",
|
||
|
|
"indicator--560a3760-57cc-4bf4-8616-e475950d210b",
|
||
|
|
"indicator--560a3761-47a4-4352-9ea0-e475950d210b",
|
||
|
|
"observed-data--560a3761-40dc-4d99-9bd7-e475950d210b",
|
||
|
|
"url--560a3761-40dc-4d99-9bd7-e475950d210b",
|
||
|
|
"indicator--560a3761-04b8-463d-8c23-e475950d210b",
|
||
|
|
"indicator--560a3762-d4f4-418d-9481-e475950d210b",
|
||
|
|
"observed-data--560a3762-d418-48c9-9343-e475950d210b",
|
||
|
|
"url--560a3762-d418-48c9-9343-e475950d210b",
|
||
|
|
"indicator--560a3762-3350-4fba-8215-e475950d210b",
|
||
|
|
"indicator--560a3763-383c-42e7-a6ce-e475950d210b",
|
||
|
|
"observed-data--560a3763-57a4-4cac-86f1-e475950d210b",
|
||
|
|
"url--560a3763-57a4-4cac-86f1-e475950d210b",
|
||
|
|
"indicator--560a3763-bcb4-4412-859a-e475950d210b",
|
||
|
|
"indicator--560a3764-74f0-4ff4-8ec3-e475950d210b",
|
||
|
|
"observed-data--560a3764-5814-4dbe-ba0d-e475950d210b",
|
||
|
|
"url--560a3764-5814-4dbe-ba0d-e475950d210b",
|
||
|
|
"indicator--560a3764-6924-40d3-8bf6-e475950d210b",
|
||
|
|
"indicator--560a3765-bc20-4516-9970-e475950d210b",
|
||
|
|
"observed-data--560a3765-4440-4d63-b488-e475950d210b",
|
||
|
|
"url--560a3765-4440-4d63-b488-e475950d210b",
|
||
|
|
"indicator--560a3765-0af4-4dad-997d-e475950d210b",
|
||
|
|
"indicator--560a3766-7888-4634-9486-e475950d210b",
|
||
|
|
"observed-data--560a3766-395c-4dbe-a568-e475950d210b",
|
||
|
|
"url--560a3766-395c-4dbe-a568-e475950d210b",
|
||
|
|
"indicator--560a3767-521c-4395-8eca-e475950d210b",
|
||
|
|
"indicator--560a3767-77b8-4fce-b8d5-e475950d210b",
|
||
|
|
"observed-data--560a3767-ab1c-49d1-85cc-e475950d210b",
|
||
|
|
"url--560a3767-ab1c-49d1-85cc-e475950d210b",
|
||
|
|
"indicator--560a3768-0724-4392-ab3b-e475950d210b",
|
||
|
|
"indicator--560a3768-02b4-49c9-9446-e475950d210b",
|
||
|
|
"observed-data--560a3768-394c-4239-bd89-e475950d210b",
|
||
|
|
"url--560a3768-394c-4239-bd89-e475950d210b",
|
||
|
|
"indicator--560a3769-e490-4975-89cc-e475950d210b",
|
||
|
|
"indicator--560a3769-ce14-43e9-9a85-e475950d210b",
|
||
|
|
"observed-data--560a3769-e1b0-4208-8eb8-e475950d210b",
|
||
|
|
"url--560a3769-e1b0-4208-8eb8-e475950d210b",
|
||
|
|
"indicator--560a376a-f9e4-4788-a864-e475950d210b",
|
||
|
|
"indicator--560a376a-f060-4d80-8f38-e475950d210b",
|
||
|
|
"observed-data--560a376a-9378-4817-914b-e475950d210b",
|
||
|
|
"url--560a376a-9378-4817-914b-e475950d210b",
|
||
|
|
"indicator--560a376b-dcd8-4bd8-bf7f-e475950d210b",
|
||
|
|
"indicator--560a376b-ed44-4056-bdcd-e475950d210b",
|
||
|
|
"observed-data--560a376b-f054-4c79-aee8-e475950d210b",
|
||
|
|
"url--560a376b-f054-4c79-aee8-e475950d210b",
|
||
|
|
"indicator--560a376c-4ce4-4e52-890c-e475950d210b",
|
||
|
|
"indicator--560a376c-bb1c-4b31-9d22-e475950d210b",
|
||
|
|
"observed-data--560a376c-d5a4-4833-b208-e475950d210b",
|
||
|
|
"url--560a376c-d5a4-4833-b208-e475950d210b",
|
||
|
|
"indicator--560a376d-0bf4-4bd5-b775-e475950d210b",
|
||
|
|
"indicator--560a376d-19bc-4bd3-900a-e475950d210b",
|
||
|
|
"observed-data--560a376e-6f48-4b1c-9d5a-e475950d210b",
|
||
|
|
"url--560a376e-6f48-4b1c-9d5a-e475950d210b",
|
||
|
|
"indicator--560a376e-9cb4-4428-a113-e475950d210b",
|
||
|
|
"indicator--560a376e-da60-495d-ae70-e475950d210b",
|
||
|
|
"observed-data--560a376f-7928-4b4b-b04a-e475950d210b",
|
||
|
|
"url--560a376f-7928-4b4b-b04a-e475950d210b",
|
||
|
|
"indicator--560a376f-5108-4c22-b0c9-e475950d210b",
|
||
|
|
"indicator--560a376f-2890-40de-8035-e475950d210b",
|
||
|
|
"observed-data--560a3770-a60c-4002-9713-e475950d210b",
|
||
|
|
"url--560a3770-a60c-4002-9713-e475950d210b",
|
||
|
|
"indicator--560a3770-d400-4c6f-b320-e475950d210b",
|
||
|
|
"indicator--560a3770-2b60-4818-99ab-e475950d210b",
|
||
|
|
"observed-data--560a3771-53a4-49b5-b5d0-e475950d210b",
|
||
|
|
"url--560a3771-53a4-49b5-b5d0-e475950d210b",
|
||
|
|
"indicator--560a3771-5118-4012-810e-e475950d210b",
|
||
|
|
"indicator--560a3771-7f00-46d8-bd7a-e475950d210b",
|
||
|
|
"observed-data--560a3772-14c4-4d36-8b9c-e475950d210b",
|
||
|
|
"url--560a3772-14c4-4d36-8b9c-e475950d210b",
|
||
|
|
"indicator--560a3772-3b64-409f-9bbc-e475950d210b",
|
||
|
|
"indicator--560a3772-66b4-4247-b821-e475950d210b",
|
||
|
|
"observed-data--560a3773-3770-4397-b59e-e475950d210b",
|
||
|
|
"url--560a3773-3770-4397-b59e-e475950d210b",
|
||
|
|
"indicator--560a3773-6fcc-4416-8bc7-e475950d210b",
|
||
|
|
"indicator--560a3774-33f0-4ef8-9606-e475950d210b",
|
||
|
|
"observed-data--560a3774-f1d4-46ee-bc93-e475950d210b",
|
||
|
|
"url--560a3774-f1d4-46ee-bc93-e475950d210b",
|
||
|
|
"indicator--560a3774-57b0-4c5f-9787-e475950d210b",
|
||
|
|
"indicator--560a3775-8f70-48eb-9904-e475950d210b",
|
||
|
|
"observed-data--560a3775-9a48-4c2d-9df6-e475950d210b",
|
||
|
|
"url--560a3775-9a48-4c2d-9df6-e475950d210b",
|
||
|
|
"indicator--560a3775-259c-4d02-9ea7-e475950d210b",
|
||
|
|
"indicator--560a3776-522c-41b7-9782-e475950d210b",
|
||
|
|
"observed-data--560a3776-4f18-4c5e-ab65-e475950d210b",
|
||
|
|
"url--560a3776-4f18-4c5e-ab65-e475950d210b",
|
||
|
|
"indicator--560a3776-2020-4374-aed1-e475950d210b",
|
||
|
|
"indicator--560a3777-296c-4f08-92f2-e475950d210b",
|
||
|
|
"observed-data--560a3777-bde0-4cf4-87ef-e475950d210b",
|
||
|
|
"url--560a3777-bde0-4cf4-87ef-e475950d210b",
|
||
|
|
"indicator--560a3777-b3bc-48c6-a8b6-e475950d210b",
|
||
|
|
"indicator--560a3778-a0a4-4d33-97d9-e475950d210b",
|
||
|
|
"observed-data--560a3778-57c0-4d02-9019-e475950d210b",
|
||
|
|
"url--560a3778-57c0-4d02-9019-e475950d210b",
|
||
|
|
"indicator--560a3778-0e78-4be2-acbc-e475950d210b",
|
||
|
|
"indicator--560a3779-0dbc-4948-84dd-e475950d210b",
|
||
|
|
"observed-data--560a3779-25c4-4ca0-9d8b-e475950d210b",
|
||
|
|
"url--560a3779-25c4-4ca0-9d8b-e475950d210b",
|
||
|
|
"indicator--560a3779-ec0c-4083-9279-e475950d210b",
|
||
|
|
"indicator--560a377a-0fd8-48b7-ac54-e475950d210b",
|
||
|
|
"observed-data--560a377a-c744-4a03-8ebb-e475950d210b",
|
||
|
|
"url--560a377a-c744-4a03-8ebb-e475950d210b",
|
||
|
|
"indicator--560a377a-5734-4231-9849-e475950d210b",
|
||
|
|
"indicator--560a377b-9ea8-48e9-94e3-e475950d210b",
|
||
|
|
"observed-data--560a377b-1924-4b9c-9a50-e475950d210b",
|
||
|
|
"url--560a377b-1924-4b9c-9a50-e475950d210b",
|
||
|
|
"indicator--560a377c-8428-49c0-8930-e475950d210b",
|
||
|
|
"indicator--560a377c-6ac4-47ae-ad3e-e475950d210b",
|
||
|
|
"observed-data--560a377c-a250-4497-bbd1-e475950d210b",
|
||
|
|
"url--560a377c-a250-4497-bbd1-e475950d210b",
|
||
|
|
"indicator--560a377d-9e1c-4254-8878-e475950d210b",
|
||
|
|
"indicator--560a377d-a164-44b7-b8aa-e475950d210b",
|
||
|
|
"observed-data--560a377d-9b90-4546-b935-e475950d210b",
|
||
|
|
"url--560a377d-9b90-4546-b935-e475950d210b",
|
||
|
|
"indicator--560a377e-70a4-4dac-bf28-e475950d210b",
|
||
|
|
"indicator--560a377e-90e0-48de-90ec-e475950d210b",
|
||
|
|
"observed-data--560a377e-f108-4071-83c4-e475950d210b",
|
||
|
|
"url--560a377e-f108-4071-83c4-e475950d210b",
|
||
|
|
"indicator--560a377f-0d8c-4e19-8000-e475950d210b",
|
||
|
|
"indicator--560a377f-f780-4824-9b84-e475950d210b",
|
||
|
|
"observed-data--560a377f-de8c-476c-92ec-e475950d210b",
|
||
|
|
"url--560a377f-de8c-476c-92ec-e475950d210b",
|
||
|
|
"indicator--560a3780-2dc0-451f-a66a-e475950d210b",
|
||
|
|
"indicator--560a3780-d450-4264-b43d-e475950d210b",
|
||
|
|
"observed-data--560a3780-8dcc-4d20-99a0-e475950d210b",
|
||
|
|
"url--560a3780-8dcc-4d20-99a0-e475950d210b",
|
||
|
|
"indicator--560a3781-e63c-4030-88a8-e475950d210b",
|
||
|
|
"indicator--560a3781-c944-48eb-8125-e475950d210b",
|
||
|
|
"observed-data--560a3781-e0b0-4176-9f7a-e475950d210b",
|
||
|
|
"url--560a3781-e0b0-4176-9f7a-e475950d210b",
|
||
|
|
"indicator--560a3782-1648-411d-a167-e475950d210b",
|
||
|
|
"indicator--560a3782-c4ec-4ce1-ba9a-e475950d210b",
|
||
|
|
"observed-data--560a3783-3f68-4f89-bcff-e475950d210b",
|
||
|
|
"url--560a3783-3f68-4f89-bcff-e475950d210b",
|
||
|
|
"indicator--560a3783-ea68-4937-a5f0-e475950d210b",
|
||
|
|
"indicator--560a3783-ae8c-4f81-bbcb-e475950d210b",
|
||
|
|
"observed-data--560a3784-922c-42ef-af28-e475950d210b",
|
||
|
|
"url--560a3784-922c-42ef-af28-e475950d210b",
|
||
|
|
"indicator--560a3784-cfe0-4990-9315-e475950d210b",
|
||
|
|
"indicator--560a3784-0a88-4838-b2c6-e475950d210b",
|
||
|
|
"observed-data--560a3785-d818-4253-8d5b-e475950d210b",
|
||
|
|
"url--560a3785-d818-4253-8d5b-e475950d210b",
|
||
|
|
"indicator--560a3785-ea64-41c9-89d9-e475950d210b",
|
||
|
|
"indicator--560a3785-8178-4e0b-9646-e475950d210b",
|
||
|
|
"observed-data--560a3786-3f58-4e0c-a925-e475950d210b",
|
||
|
|
"url--560a3786-3f58-4e0c-a925-e475950d210b",
|
||
|
|
"indicator--560a3786-cb88-4f47-81ff-e475950d210b",
|
||
|
|
"indicator--560a3786-aa30-4775-8915-e475950d210b",
|
||
|
|
"observed-data--560a3787-f4a4-48cb-8568-e475950d210b",
|
||
|
|
"url--560a3787-f4a4-48cb-8568-e475950d210b",
|
||
|
|
"indicator--560a3787-d6dc-41fc-beb7-e475950d210b",
|
||
|
|
"indicator--560a3787-c67c-4d05-a729-e475950d210b",
|
||
|
|
"observed-data--560a3788-eee4-4968-93cd-e475950d210b",
|
||
|
|
"url--560a3788-eee4-4968-93cd-e475950d210b",
|
||
|
|
"indicator--560a3788-62d8-4701-8ac3-e475950d210b",
|
||
|
|
"indicator--560a3789-448c-4063-9ac3-e475950d210b",
|
||
|
|
"observed-data--560a3789-8c9c-4c85-87d1-e475950d210b",
|
||
|
|
"url--560a3789-8c9c-4c85-87d1-e475950d210b",
|
||
|
|
"indicator--560a3789-05ac-4b5a-80f0-e475950d210b",
|
||
|
|
"indicator--560a378a-b39c-4734-b52d-e475950d210b",
|
||
|
|
"observed-data--560a378a-db6c-4bab-ba6b-e475950d210b",
|
||
|
|
"url--560a378a-db6c-4bab-ba6b-e475950d210b",
|
||
|
|
"indicator--560a378a-1928-48db-9a2f-e475950d210b",
|
||
|
|
"indicator--560a378b-bfec-4ec3-a3c4-e475950d210b",
|
||
|
|
"observed-data--560a378b-6964-4ad4-85f3-e475950d210b",
|
||
|
|
"url--560a378b-6964-4ad4-85f3-e475950d210b",
|
||
|
|
"indicator--560a378b-547c-4cc0-b29c-e475950d210b",
|
||
|
|
"indicator--560a378c-e4ec-423b-8920-e475950d210b",
|
||
|
|
"observed-data--560a378c-8370-4d98-b86c-e475950d210b",
|
||
|
|
"url--560a378c-8370-4d98-b86c-e475950d210b",
|
||
|
|
"indicator--560a378c-475c-4c96-84e5-e475950d210b",
|
||
|
|
"indicator--560a378d-8e5c-4da4-9872-e475950d210b",
|
||
|
|
"observed-data--560a378d-6450-41cf-a9df-e475950d210b",
|
||
|
|
"url--560a378d-6450-41cf-a9df-e475950d210b",
|
||
|
|
"indicator--560a378d-3de4-4ac1-95f9-e475950d210b",
|
||
|
|
"indicator--560a378e-0b40-49fc-a63f-e475950d210b",
|
||
|
|
"observed-data--560a378e-b608-41bd-b7f3-e475950d210b",
|
||
|
|
"url--560a378e-b608-41bd-b7f3-e475950d210b",
|
||
|
|
"indicator--560a378e-e380-48fe-bd0f-e475950d210b",
|
||
|
|
"indicator--560a378f-2510-4f9e-a679-e475950d210b",
|
||
|
|
"observed-data--560a378f-b8b0-44a2-8b72-e475950d210b",
|
||
|
|
"url--560a378f-b8b0-44a2-8b72-e475950d210b",
|
||
|
|
"indicator--560a3790-1e48-4799-91be-e475950d210b",
|
||
|
|
"indicator--560a3790-d8e4-403b-b061-e475950d210b",
|
||
|
|
"observed-data--560a3790-327c-4570-a263-e475950d210b",
|
||
|
|
"url--560a3790-327c-4570-a263-e475950d210b",
|
||
|
|
"indicator--560a3791-bc00-4cca-aeb1-e475950d210b",
|
||
|
|
"indicator--560a3791-f4c8-4536-98ba-e475950d210b",
|
||
|
|
"observed-data--560a3791-4ac8-4fac-8d2f-e475950d210b",
|
||
|
|
"url--560a3791-4ac8-4fac-8d2f-e475950d210b",
|
||
|
|
"indicator--560a3792-d9d8-4784-af5d-e475950d210b",
|
||
|
|
"indicator--560a3792-919c-42e0-b28a-e475950d210b",
|
||
|
|
"observed-data--560a3792-7c7c-4019-a062-e475950d210b",
|
||
|
|
"url--560a3792-7c7c-4019-a062-e475950d210b",
|
||
|
|
"indicator--560a3793-ddd8-4b26-93de-e475950d210b",
|
||
|
|
"indicator--560a3793-e118-49ed-928d-e475950d210b",
|
||
|
|
"observed-data--560a3793-8468-4b19-83a6-e475950d210b",
|
||
|
|
"url--560a3793-8468-4b19-83a6-e475950d210b",
|
||
|
|
"indicator--560a3794-9f90-4e7a-8b06-e475950d210b",
|
||
|
|
"indicator--560a3794-e56c-4aa3-9994-e475950d210b",
|
||
|
|
"observed-data--560a3794-b024-4e64-b4c3-e475950d210b",
|
||
|
|
"url--560a3794-b024-4e64-b4c3-e475950d210b",
|
||
|
|
"indicator--560a3795-4a84-4c04-8a73-e475950d210b",
|
||
|
|
"indicator--560a3795-ca04-403f-a512-e475950d210b",
|
||
|
|
"observed-data--560a3795-bbf8-4610-b9a5-e475950d210b",
|
||
|
|
"url--560a3795-bbf8-4610-b9a5-e475950d210b",
|
||
|
|
"indicator--560a3796-3fa0-4aa6-a007-e475950d210b",
|
||
|
|
"indicator--560a3796-62c8-4a9e-bffd-e475950d210b",
|
||
|
|
"observed-data--560a3797-7124-4ce3-a34d-e475950d210b",
|
||
|
|
"url--560a3797-7124-4ce3-a34d-e475950d210b",
|
||
|
|
"indicator--560a3797-ebe0-45cd-b359-e475950d210b",
|
||
|
|
"indicator--560a3797-8794-49c3-8c02-e475950d210b",
|
||
|
|
"observed-data--560a3798-2b38-4bfb-b82d-e475950d210b",
|
||
|
|
"url--560a3798-2b38-4bfb-b82d-e475950d210b",
|
||
|
|
"indicator--560a3798-0830-4498-9249-e475950d210b",
|
||
|
|
"indicator--560a3798-1a98-4604-a3c5-e475950d210b",
|
||
|
|
"observed-data--560a3799-bcbc-484e-a391-e475950d210b",
|
||
|
|
"url--560a3799-bcbc-484e-a391-e475950d210b",
|
||
|
|
"indicator--560a3799-07dc-429c-9a16-e475950d210b",
|
||
|
|
"indicator--560a3799-3f80-47b4-8709-e475950d210b",
|
||
|
|
"observed-data--560a379a-5cf4-4abe-8b62-e475950d210b",
|
||
|
|
"url--560a379a-5cf4-4abe-8b62-e475950d210b",
|
||
|
|
"indicator--560a379a-9608-454f-ad8b-e475950d210b",
|
||
|
|
"indicator--560a379a-7ac4-4a24-8953-e475950d210b",
|
||
|
|
"observed-data--560a379b-f718-4cd9-a73b-e475950d210b",
|
||
|
|
"url--560a379b-f718-4cd9-a73b-e475950d210b",
|
||
|
|
"indicator--560a379b-aa38-4275-9e4b-e475950d210b",
|
||
|
|
"indicator--560a379b-aa44-4014-bb62-e475950d210b",
|
||
|
|
"observed-data--560a379c-d52c-4a76-8ee9-e475950d210b",
|
||
|
|
"url--560a379c-d52c-4a76-8ee9-e475950d210b",
|
||
|
|
"indicator--560a379c-423c-4791-bfc7-e475950d210b",
|
||
|
|
"indicator--560a379c-c704-40b0-b2c3-e475950d210b",
|
||
|
|
"observed-data--560a379d-b79c-4554-962d-e475950d210b",
|
||
|
|
"url--560a379d-b79c-4554-962d-e475950d210b",
|
||
|
|
"indicator--560a379d-5208-42b0-8f42-e475950d210b",
|
||
|
|
"indicator--560a379e-a104-42f8-b6a7-e475950d210b",
|
||
|
|
"observed-data--560a379e-e380-49c4-aa6c-e475950d210b",
|
||
|
|
"url--560a379e-e380-49c4-aa6c-e475950d210b",
|
||
|
|
"indicator--560a379e-6d54-466e-bbef-e475950d210b",
|
||
|
|
"indicator--560a379f-dea4-4627-8223-e475950d210b",
|
||
|
|
"observed-data--560a379f-d888-4eac-b43f-e475950d210b",
|
||
|
|
"url--560a379f-d888-4eac-b43f-e475950d210b",
|
||
|
|
"indicator--560a379f-8d7c-4741-be91-e475950d210b",
|
||
|
|
"indicator--560a37a0-9718-46bc-a40b-e475950d210b",
|
||
|
|
"observed-data--560a37a0-1068-4458-94c7-e475950d210b",
|
||
|
|
"url--560a37a0-1068-4458-94c7-e475950d210b",
|
||
|
|
"indicator--560a37a0-4cdc-4a24-9a82-e475950d210b",
|
||
|
|
"indicator--560a37a1-609c-4b9d-b225-e475950d210b",
|
||
|
|
"observed-data--560a37a1-ebdc-445c-9d06-e475950d210b",
|
||
|
|
"url--560a37a1-ebdc-445c-9d06-e475950d210b",
|
||
|
|
"indicator--560a37a1-a34c-44db-b278-e475950d210b",
|
||
|
|
"indicator--560a37a2-f320-443a-af55-e475950d210b",
|
||
|
|
"observed-data--560a37a2-668c-43fb-a610-e475950d210b",
|
||
|
|
"url--560a37a2-668c-43fb-a610-e475950d210b",
|
||
|
|
"indicator--560a37a2-2a4c-4976-bfce-e475950d210b",
|
||
|
|
"indicator--560a37a3-a07c-48b5-863c-e475950d210b",
|
||
|
|
"observed-data--560a37a3-26c8-46eb-80df-e475950d210b",
|
||
|
|
"url--560a37a3-26c8-46eb-80df-e475950d210b",
|
||
|
|
"indicator--560a37a3-d710-4544-bb33-e475950d210b",
|
||
|
|
"indicator--560a37a4-0290-4e58-b5d1-e475950d210b",
|
||
|
|
"observed-data--560a37a4-4424-423c-8587-e475950d210b",
|
||
|
|
"url--560a37a4-4424-423c-8587-e475950d210b",
|
||
|
|
"indicator--560a37a4-9248-4c4d-b16a-e475950d210b",
|
||
|
|
"indicator--560a37a5-5ff0-477a-9a52-e475950d210b",
|
||
|
|
"observed-data--560a37a5-b1f8-4eb6-ad23-e475950d210b",
|
||
|
|
"url--560a37a5-b1f8-4eb6-ad23-e475950d210b",
|
||
|
|
"indicator--560a37a6-4034-4c71-a73f-e475950d210b",
|
||
|
|
"indicator--560a37a6-69f8-4c75-81c3-e475950d210b",
|
||
|
|
"observed-data--560a37a6-3828-42a6-9008-e475950d210b",
|
||
|
|
"url--560a37a6-3828-42a6-9008-e475950d210b",
|
||
|
|
"indicator--560a37a7-e0e0-4f7d-9ebf-e475950d210b",
|
||
|
|
"indicator--560a37a7-6ba0-43d5-9362-e475950d210b",
|
||
|
|
"observed-data--560a37a7-08a4-4787-9363-e475950d210b",
|
||
|
|
"url--560a37a7-08a4-4787-9363-e475950d210b",
|
||
|
|
"indicator--560a37a8-2bd8-483c-87a2-e475950d210b",
|
||
|
|
"indicator--560a37a8-03a0-4db3-b297-e475950d210b",
|
||
|
|
"observed-data--560a37a8-0e2c-41d6-bf7d-e475950d210b",
|
||
|
|
"url--560a37a8-0e2c-41d6-bf7d-e475950d210b",
|
||
|
|
"indicator--560a37a9-52b4-479a-adb5-e475950d210b",
|
||
|
|
"indicator--560a37a9-0ce8-4afa-a834-e475950d210b",
|
||
|
|
"observed-data--560a37a9-b13c-4b3a-b99c-e475950d210b",
|
||
|
|
"url--560a37a9-b13c-4b3a-b99c-e475950d210b",
|
||
|
|
"indicator--560a37aa-9eec-442e-9e0b-e475950d210b",
|
||
|
|
"indicator--560a37aa-5f14-47de-839d-e475950d210b",
|
||
|
|
"observed-data--560a37aa-5a70-40ab-85b2-e475950d210b",
|
||
|
|
"url--560a37aa-5a70-40ab-85b2-e475950d210b",
|
||
|
|
"indicator--560a37ab-a100-4d10-a8f0-e475950d210b",
|
||
|
|
"indicator--560a37ab-8570-465c-a006-e475950d210b",
|
||
|
|
"observed-data--560a37ab-a230-43e7-9e07-e475950d210b",
|
||
|
|
"url--560a37ab-a230-43e7-9e07-e475950d210b",
|
||
|
|
"indicator--560a37ac-2f6c-4ace-a50f-e475950d210b",
|
||
|
|
"indicator--560a37ac-ddd8-4b24-8d70-e475950d210b",
|
||
|
|
"observed-data--560a37ad-06c4-4ad4-9145-e475950d210b",
|
||
|
|
"url--560a37ad-06c4-4ad4-9145-e475950d210b",
|
||
|
|
"indicator--560a37ad-7208-45f3-89cb-e475950d210b",
|
||
|
|
"indicator--560a37ad-89c4-4186-8ede-e475950d210b",
|
||
|
|
"observed-data--560a37ae-8758-436a-b8b6-e475950d210b",
|
||
|
|
"url--560a37ae-8758-436a-b8b6-e475950d210b",
|
||
|
|
"indicator--560a37ae-65e0-4b28-b19d-e475950d210b",
|
||
|
|
"indicator--560a37ae-bb1c-47d8-b3f4-e475950d210b",
|
||
|
|
"observed-data--560a37af-98c8-400c-960b-e475950d210b",
|
||
|
|
"url--560a37af-98c8-400c-960b-e475950d210b",
|
||
|
|
"indicator--560a37af-86b4-47f6-b3a6-e475950d210b",
|
||
|
|
"indicator--560a37af-5860-4336-b180-e475950d210b",
|
||
|
|
"observed-data--560a37b0-23a4-419e-b6df-e475950d210b",
|
||
|
|
"url--560a37b0-23a4-419e-b6df-e475950d210b",
|
||
|
|
"indicator--560a37b0-cce8-4c8b-adf3-e475950d210b",
|
||
|
|
"indicator--560a37b0-286c-4cf1-a997-e475950d210b",
|
||
|
|
"observed-data--560a37b1-3c3c-431e-94b0-e475950d210b",
|
||
|
|
"url--560a37b1-3c3c-431e-94b0-e475950d210b",
|
||
|
|
"indicator--560a37b1-d048-45cc-bd48-e475950d210b",
|
||
|
|
"indicator--560a37b1-01f0-4056-bb12-e475950d210b",
|
||
|
|
"observed-data--560a37b2-4264-422a-9231-e475950d210b",
|
||
|
|
"url--560a37b2-4264-422a-9231-e475950d210b",
|
||
|
|
"indicator--560a37b2-31a8-4185-a192-e475950d210b",
|
||
|
|
"indicator--560a37b2-6328-496d-a086-e475950d210b",
|
||
|
|
"observed-data--560a37b3-673c-4866-8300-e475950d210b",
|
||
|
|
"url--560a37b3-673c-4866-8300-e475950d210b",
|
||
|
|
"indicator--560a37b3-e47c-4281-a5cc-e475950d210b",
|
||
|
|
"indicator--560a37b4-96ec-4eb5-9a81-e475950d210b",
|
||
|
|
"observed-data--560a37b4-ceb8-4a5b-9f22-e475950d210b",
|
||
|
|
"url--560a37b4-ceb8-4a5b-9f22-e475950d210b",
|
||
|
|
"indicator--560a37b4-9a78-4c5f-bf12-e475950d210b",
|
||
|
|
"indicator--560a37b5-23d0-4ac6-bb80-e475950d210b",
|
||
|
|
"observed-data--560a37b5-b954-4476-b806-e475950d210b",
|
||
|
|
"url--560a37b5-b954-4476-b806-e475950d210b",
|
||
|
|
"indicator--560a37b5-35f0-40dc-83b5-e475950d210b",
|
||
|
|
"indicator--560a37b6-62d4-4ef2-a744-e475950d210b",
|
||
|
|
"observed-data--560a37b6-f088-4790-afc6-e475950d210b",
|
||
|
|
"url--560a37b6-f088-4790-afc6-e475950d210b",
|
||
|
|
"indicator--560a37b6-fa58-4e61-b8b0-e475950d210b",
|
||
|
|
"indicator--560a37b7-8cec-463f-b1b2-e475950d210b",
|
||
|
|
"observed-data--560a37b7-ff64-4d2f-84f8-e475950d210b",
|
||
|
|
"url--560a37b7-ff64-4d2f-84f8-e475950d210b",
|
||
|
|
"indicator--560a37b7-a76c-43ee-bad5-e475950d210b",
|
||
|
|
"indicator--560a37b8-dbec-4ca7-b0fb-e475950d210b",
|
||
|
|
"observed-data--560a37b8-8388-4c5b-a569-e475950d210b",
|
||
|
|
"url--560a37b8-8388-4c5b-a569-e475950d210b",
|
||
|
|
"indicator--560a37b8-b614-4cbb-85db-e475950d210b",
|
||
|
|
"indicator--560a37b9-84c4-41c2-bc4a-e475950d210b",
|
||
|
|
"observed-data--560a37b9-013c-42dc-855a-e475950d210b",
|
||
|
|
"url--560a37b9-013c-42dc-855a-e475950d210b",
|
||
|
|
"indicator--560a37b9-25dc-44f5-a50e-e475950d210b",
|
||
|
|
"indicator--560a37ba-1870-4880-8b80-e475950d210b",
|
||
|
|
"observed-data--560a37ba-6390-4a18-82f8-e475950d210b",
|
||
|
|
"url--560a37ba-6390-4a18-82f8-e475950d210b",
|
||
|
|
"indicator--560a37bb-4068-4f90-a910-e475950d210b",
|
||
|
|
"indicator--560a37bb-d80c-4fd0-a86c-e475950d210b",
|
||
|
|
"observed-data--560a37bb-dd94-4510-8ed7-e475950d210b",
|
||
|
|
"url--560a37bb-dd94-4510-8ed7-e475950d210b",
|
||
|
|
"indicator--560a37bc-dd74-4e56-9c28-e475950d210b",
|
||
|
|
"indicator--560a37bc-8130-4250-bf79-e475950d210b",
|
||
|
|
"observed-data--560a37bc-99e0-480c-898c-e475950d210b",
|
||
|
|
"url--560a37bc-99e0-480c-898c-e475950d210b",
|
||
|
|
"indicator--560a37bd-9ff8-4e1b-8d62-e475950d210b",
|
||
|
|
"indicator--560a37bd-2250-4a7c-9f6f-e475950d210b",
|
||
|
|
"observed-data--560a37bd-2d1c-43f2-b797-e475950d210b",
|
||
|
|
"url--560a37bd-2d1c-43f2-b797-e475950d210b",
|
||
|
|
"indicator--560a37be-ec8c-4b91-8a2f-e475950d210b",
|
||
|
|
"indicator--560a37be-f0f4-4a1b-b93b-e475950d210b",
|
||
|
|
"observed-data--560a37be-5c9c-4633-be41-e475950d210b",
|
||
|
|
"url--560a37be-5c9c-4633-be41-e475950d210b",
|
||
|
|
"indicator--560a37bf-9280-4ee0-8e88-e475950d210b",
|
||
|
|
"indicator--560a37bf-18bc-49db-8eed-e475950d210b",
|
||
|
|
"observed-data--560a37bf-c340-4636-af9a-e475950d210b",
|
||
|
|
"url--560a37bf-c340-4636-af9a-e475950d210b",
|
||
|
|
"indicator--560a37c0-c528-4de0-b787-e475950d210b",
|
||
|
|
"indicator--560a37c0-a3b0-402f-9814-e475950d210b",
|
||
|
|
"observed-data--560a37c1-2c90-4cde-a665-e475950d210b",
|
||
|
|
"url--560a37c1-2c90-4cde-a665-e475950d210b",
|
||
|
|
"indicator--560a37c1-ddc0-4c6f-b0ae-e475950d210b",
|
||
|
|
"indicator--560a37c1-7230-4e32-90eb-e475950d210b",
|
||
|
|
"observed-data--560a37c2-4b7c-4fe7-b533-e475950d210b",
|
||
|
|
"url--560a37c2-4b7c-4fe7-b533-e475950d210b",
|
||
|
|
"indicator--560a37c2-3a00-41c5-afd3-e475950d210b",
|
||
|
|
"indicator--560a37c2-fd54-4f81-9496-e475950d210b",
|
||
|
|
"observed-data--560a37c3-1a48-49eb-a486-e475950d210b",
|
||
|
|
"url--560a37c3-1a48-49eb-a486-e475950d210b",
|
||
|
|
"indicator--560a37c3-71f8-4921-9224-e475950d210b",
|
||
|
|
"indicator--560a37c3-99f8-445d-a162-e475950d210b",
|
||
|
|
"observed-data--560a37c4-f4e4-4b02-a7b5-e475950d210b",
|
||
|
|
"url--560a37c4-f4e4-4b02-a7b5-e475950d210b",
|
||
|
|
"indicator--560a37c4-0338-4a53-93f7-e475950d210b",
|
||
|
|
"indicator--560a37c4-b9ec-4205-904d-e475950d210b",
|
||
|
|
"observed-data--560a37c5-89d0-480f-b788-e475950d210b",
|
||
|
|
"url--560a37c5-89d0-480f-b788-e475950d210b",
|
||
|
|
"indicator--560a37c5-74d8-498e-8347-e475950d210b",
|
||
|
|
"indicator--560a37c5-0da4-4858-85d0-e475950d210b",
|
||
|
|
"observed-data--560a37c6-d500-45e8-9ded-e475950d210b",
|
||
|
|
"url--560a37c6-d500-45e8-9ded-e475950d210b",
|
||
|
|
"indicator--560a37c6-56b4-468d-9107-e475950d210b",
|
||
|
|
"indicator--560a37c6-b14c-41e9-8a06-e475950d210b",
|
||
|
|
"observed-data--560a37c7-3138-421e-975f-e475950d210b",
|
||
|
|
"url--560a37c7-3138-421e-975f-e475950d210b",
|
||
|
|
"indicator--560a37c7-a6d0-491f-8e8f-e475950d210b",
|
||
|
|
"indicator--560a37c8-2518-492b-8a5d-e475950d210b",
|
||
|
|
"observed-data--560a37c8-6248-4044-92a4-e475950d210b",
|
||
|
|
"url--560a37c8-6248-4044-92a4-e475950d210b",
|
||
|
|
"indicator--560a37c8-29b8-4cb2-ab71-e475950d210b",
|
||
|
|
"indicator--560a37c9-18e4-4c38-bc99-e475950d210b",
|
||
|
|
"observed-data--560a37c9-6524-459b-9663-e475950d210b",
|
||
|
|
"url--560a37c9-6524-459b-9663-e475950d210b",
|
||
|
|
"indicator--560a37c9-adc0-4c5f-bc57-e475950d210b",
|
||
|
|
"indicator--560a37ca-0110-40cf-8d8a-e475950d210b",
|
||
|
|
"observed-data--560a37ca-4d88-4958-9bd2-e475950d210b",
|
||
|
|
"url--560a37ca-4d88-4958-9bd2-e475950d210b",
|
||
|
|
"indicator--560a37ca-0330-4abf-a977-e475950d210b",
|
||
|
|
"indicator--560a37cb-5694-48b3-93e4-e475950d210b",
|
||
|
|
"observed-data--560a37cb-f050-4c8a-9659-e475950d210b",
|
||
|
|
"url--560a37cb-f050-4c8a-9659-e475950d210b",
|
||
|
|
"indicator--560a37cb-7dd0-4480-bf10-e475950d210b",
|
||
|
|
"indicator--560a37cc-ef3c-4024-86d1-e475950d210b",
|
||
|
|
"observed-data--560a37cc-3e68-45a6-9a74-e475950d210b",
|
||
|
|
"url--560a37cc-3e68-45a6-9a74-e475950d210b",
|
||
|
|
"indicator--560a37cc-5eb8-4854-b27f-e475950d210b",
|
||
|
|
"indicator--560a37cd-6968-4b7f-8b28-e475950d210b",
|
||
|
|
"observed-data--560a37cd-340c-4e01-baa6-e475950d210b",
|
||
|
|
"url--560a37cd-340c-4e01-baa6-e475950d210b",
|
||
|
|
"indicator--560a37cd-3984-4f8e-9fc9-e475950d210b",
|
||
|
|
"indicator--560a37ce-7828-4116-ad4b-e475950d210b",
|
||
|
|
"observed-data--560a37ce-b518-4cfb-8c8c-e475950d210b",
|
||
|
|
"url--560a37ce-b518-4cfb-8c8c-e475950d210b",
|
||
|
|
"indicator--560a37cf-8864-4118-bfcb-e475950d210b",
|
||
|
|
"indicator--560a37cf-b660-4b80-b837-e475950d210b",
|
||
|
|
"observed-data--560a37cf-c7cc-4d8c-9632-e475950d210b",
|
||
|
|
"url--560a37cf-c7cc-4d8c-9632-e475950d210b",
|
||
|
|
"indicator--560a37d0-a768-4d77-95d1-e475950d210b",
|
||
|
|
"indicator--560a37d0-888c-442a-b3bb-e475950d210b",
|
||
|
|
"observed-data--560a37d0-f710-409d-8bdf-e475950d210b",
|
||
|
|
"url--560a37d0-f710-409d-8bdf-e475950d210b",
|
||
|
|
"indicator--560a37d1-e000-4ec1-a42d-e475950d210b",
|
||
|
|
"indicator--560a37d1-dcbc-4af3-9df4-e475950d210b",
|
||
|
|
"observed-data--560a37d1-9a6c-4bb3-bcc3-e475950d210b",
|
||
|
|
"url--560a37d1-9a6c-4bb3-bcc3-e475950d210b",
|
||
|
|
"indicator--560a37d2-3ed8-4575-ad00-e475950d210b",
|
||
|
|
"indicator--560a37d2-dbe8-49b1-abdb-e475950d210b",
|
||
|
|
"observed-data--560a37d2-bf70-466d-8cc6-e475950d210b",
|
||
|
|
"url--560a37d2-bf70-466d-8cc6-e475950d210b",
|
||
|
|
"indicator--560a37d3-4104-4a91-aca1-e475950d210b",
|
||
|
|
"indicator--560a37d3-2ab4-4149-b10a-e475950d210b",
|
||
|
|
"observed-data--560a37d3-7f88-4e67-9051-e475950d210b",
|
||
|
|
"url--560a37d3-7f88-4e67-9051-e475950d210b",
|
||
|
|
"indicator--560a37d4-fc48-4cb5-8edc-e475950d210b",
|
||
|
|
"indicator--560a37d4-c480-4acb-b047-e475950d210b",
|
||
|
|
"observed-data--560a37d4-b3f8-40b7-b919-e475950d210b",
|
||
|
|
"url--560a37d4-b3f8-40b7-b919-e475950d210b",
|
||
|
|
"indicator--560a37d5-a78c-41aa-930c-e475950d210b",
|
||
|
|
"indicator--560a37d5-f018-4859-86af-e475950d210b",
|
||
|
|
"observed-data--560a37d6-1c58-44f7-b059-e475950d210b",
|
||
|
|
"url--560a37d6-1c58-44f7-b059-e475950d210b",
|
||
|
|
"indicator--560a37d6-d7dc-4a9f-8a52-e475950d210b",
|
||
|
|
"indicator--560a37d6-e050-4d2b-9618-e475950d210b",
|
||
|
|
"observed-data--560a37d7-4aec-465d-ae04-e475950d210b",
|
||
|
|
"url--560a37d7-4aec-465d-ae04-e475950d210b",
|
||
|
|
"indicator--560a37d7-4854-420f-993f-e475950d210b",
|
||
|
|
"indicator--560a37d7-fcc4-4106-9530-e475950d210b",
|
||
|
|
"observed-data--560a37d8-009c-4bcc-acf2-e475950d210b",
|
||
|
|
"url--560a37d8-009c-4bcc-acf2-e475950d210b",
|
||
|
|
"indicator--560a37d8-e400-44d2-a7e0-e475950d210b",
|
||
|
|
"indicator--560a37d8-a7bc-45e8-b20f-e475950d210b",
|
||
|
|
"observed-data--560a37d9-0e00-4600-8c0b-e475950d210b",
|
||
|
|
"url--560a37d9-0e00-4600-8c0b-e475950d210b",
|
||
|
|
"indicator--560a37d9-0488-403a-b402-e475950d210b",
|
||
|
|
"indicator--560a37d9-c528-406c-8681-e475950d210b",
|
||
|
|
"observed-data--560a37da-ee74-42b6-8646-e475950d210b",
|
||
|
|
"url--560a37da-ee74-42b6-8646-e475950d210b",
|
||
|
|
"indicator--560a37da-8090-4e4c-befc-e475950d210b",
|
||
|
|
"indicator--560a37da-8194-4b6e-a507-e475950d210b",
|
||
|
|
"observed-data--560a37db-bef4-4bcf-aabf-e475950d210b",
|
||
|
|
"url--560a37db-bef4-4bcf-aabf-e475950d210b",
|
||
|
|
"indicator--560a37db-3e38-48aa-9586-e475950d210b",
|
||
|
|
"indicator--560a37db-67c8-4a93-a1fe-e475950d210b",
|
||
|
|
"observed-data--560a37dc-4a0c-43af-be71-e475950d210b",
|
||
|
|
"url--560a37dc-4a0c-43af-be71-e475950d210b",
|
||
|
|
"indicator--560a37dc-3a3c-44f1-9792-e475950d210b",
|
||
|
|
"indicator--560a37dd-05d4-422d-adc6-e475950d210b",
|
||
|
|
"observed-data--560a37dd-d0d8-4b87-b141-e475950d210b",
|
||
|
|
"url--560a37dd-d0d8-4b87-b141-e475950d210b",
|
||
|
|
"indicator--560a37dd-c79c-4a6d-8950-e475950d210b",
|
||
|
|
"indicator--560a37de-af68-4c1f-a74c-e475950d210b",
|
||
|
|
"observed-data--560a37de-c0cc-4a74-ba47-e475950d210b",
|
||
|
|
"url--560a37de-c0cc-4a74-ba47-e475950d210b",
|
||
|
|
"indicator--560a37de-8af8-4ad1-816b-e475950d210b",
|
||
|
|
"indicator--560a37df-f568-44c9-8058-e475950d210b",
|
||
|
|
"observed-data--560a37df-618c-4133-8a83-e475950d210b",
|
||
|
|
"url--560a37df-618c-4133-8a83-e475950d210b",
|
||
|
|
"indicator--560a37df-1388-4872-94b6-e475950d210b",
|
||
|
|
"indicator--560a37e0-f958-4c0d-90e5-e475950d210b",
|
||
|
|
"observed-data--560a37e0-b63c-4cca-aa65-e475950d210b",
|
||
|
|
"url--560a37e0-b63c-4cca-aa65-e475950d210b",
|
||
|
|
"indicator--560a37e0-b508-4667-8119-e475950d210b",
|
||
|
|
"indicator--560a37e1-0378-4430-83d6-e475950d210b",
|
||
|
|
"observed-data--560a37e1-0fd4-49a8-b466-e475950d210b",
|
||
|
|
"url--560a37e1-0fd4-49a8-b466-e475950d210b",
|
||
|
|
"indicator--560a37e1-94fc-4544-aecb-e475950d210b",
|
||
|
|
"indicator--560a37e2-2630-4515-8efa-e475950d210b",
|
||
|
|
"observed-data--560a37e2-2b60-4dc1-8bd5-e475950d210b",
|
||
|
|
"url--560a37e2-2b60-4dc1-8bd5-e475950d210b",
|
||
|
|
"indicator--560a37e2-dc10-476d-9e83-e475950d210b",
|
||
|
|
"indicator--560a37e3-3510-469a-aa6c-e475950d210b",
|
||
|
|
"observed-data--560a37e3-b72c-4a5a-9c7a-e475950d210b",
|
||
|
|
"url--560a37e3-b72c-4a5a-9c7a-e475950d210b",
|
||
|
|
"indicator--560a37e3-5870-4996-968d-e475950d210b",
|
||
|
|
"indicator--560a37e4-97cc-4b02-b8cf-e475950d210b",
|
||
|
|
"observed-data--560a37e4-1e38-44d0-9913-e475950d210b",
|
||
|
|
"url--560a37e4-1e38-44d0-9913-e475950d210b",
|
||
|
|
"indicator--560a37e5-31e8-41af-996a-e475950d210b",
|
||
|
|
"indicator--560a37e5-9a28-4416-84d8-e475950d210b",
|
||
|
|
"observed-data--560a37e5-1074-4683-8330-e475950d210b",
|
||
|
|
"url--560a37e5-1074-4683-8330-e475950d210b",
|
||
|
|
"indicator--560a37e6-4268-4948-81be-e475950d210b",
|
||
|
|
"indicator--560a37e6-e994-4754-89b7-e475950d210b",
|
||
|
|
"observed-data--560a37e6-2508-4467-8d8e-e475950d210b",
|
||
|
|
"url--560a37e6-2508-4467-8d8e-e475950d210b",
|
||
|
|
"indicator--560a37e7-c598-487b-b6dd-e475950d210b",
|
||
|
|
"indicator--560a37e7-a1b4-417c-9b2c-e475950d210b",
|
||
|
|
"observed-data--560a37e7-1f74-48cd-952a-e475950d210b",
|
||
|
|
"url--560a37e7-1f74-48cd-952a-e475950d210b",
|
||
|
|
"indicator--560a37e8-43dc-43ba-add3-e475950d210b",
|
||
|
|
"indicator--560a37e8-8060-4aaa-bf92-e475950d210b",
|
||
|
|
"observed-data--560a37e8-73bc-4527-b358-e475950d210b",
|
||
|
|
"url--560a37e8-73bc-4527-b358-e475950d210b",
|
||
|
|
"indicator--560a37e9-0e04-48e5-918f-e475950d210b",
|
||
|
|
"indicator--560a37e9-25d0-4232-9f68-e475950d210b",
|
||
|
|
"observed-data--560a37e9-50b4-4a91-a826-e475950d210b",
|
||
|
|
"url--560a37e9-50b4-4a91-a826-e475950d210b",
|
||
|
|
"indicator--560a37ea-9cc8-441f-9be5-e475950d210b",
|
||
|
|
"indicator--560a37ea-bd44-4520-a396-e475950d210b",
|
||
|
|
"observed-data--560a37ea-a104-46ed-a673-e475950d210b",
|
||
|
|
"url--560a37ea-a104-46ed-a673-e475950d210b",
|
||
|
|
"indicator--560a37eb-4194-4379-b78a-e475950d210b",
|
||
|
|
"indicator--560a37eb-c114-414b-a157-e475950d210b",
|
||
|
|
"observed-data--560a37eb-1c8c-4cbd-9768-e475950d210b",
|
||
|
|
"url--560a37eb-1c8c-4cbd-9768-e475950d210b",
|
||
|
|
"indicator--560a37ec-f328-4ee5-9c0c-e475950d210b",
|
||
|
|
"indicator--560a37ec-2bd4-4028-8ade-e475950d210b",
|
||
|
|
"observed-data--560a37ed-6680-45a4-94f1-e475950d210b",
|
||
|
|
"url--560a37ed-6680-45a4-94f1-e475950d210b",
|
||
|
|
"indicator--560a37ed-3908-4554-b346-e475950d210b",
|
||
|
|
"indicator--560a37ed-071c-4184-838e-e475950d210b",
|
||
|
|
"observed-data--560a37ee-9e28-4edf-b349-e475950d210b",
|
||
|
|
"url--560a37ee-9e28-4edf-b349-e475950d210b",
|
||
|
|
"indicator--560a37ee-8b34-4171-b48b-e475950d210b",
|
||
|
|
"indicator--560a37ee-a518-4b06-8970-e475950d210b",
|
||
|
|
"observed-data--560a37ef-82c0-4171-855d-e475950d210b",
|
||
|
|
"url--560a37ef-82c0-4171-855d-e475950d210b",
|
||
|
|
"indicator--560a37ef-25b0-4bd4-aee3-e475950d210b",
|
||
|
|
"indicator--560a37ef-f48c-4768-bf21-e475950d210b",
|
||
|
|
"observed-data--560a37f0-25d0-4496-837b-e475950d210b",
|
||
|
|
"url--560a37f0-25d0-4496-837b-e475950d210b",
|
||
|
|
"indicator--560a37f0-2ca4-4447-87c0-e475950d210b",
|
||
|
|
"indicator--560a37f0-1444-428d-93e3-e475950d210b",
|
||
|
|
"observed-data--560a37f1-2264-4d5a-b464-e475950d210b",
|
||
|
|
"url--560a37f1-2264-4d5a-b464-e475950d210b",
|
||
|
|
"indicator--560a37f1-e2d8-4821-a70c-e475950d210b",
|
||
|
|
"indicator--560a37f1-5c70-4740-b701-e475950d210b",
|
||
|
|
"observed-data--560a37f2-2460-446b-adb0-e475950d210b",
|
||
|
|
"url--560a37f2-2460-446b-adb0-e475950d210b",
|
||
|
|
"indicator--560a37f2-38d8-4491-8c32-e475950d210b",
|
||
|
|
"indicator--560a37f2-333c-4c72-b0fd-e475950d210b",
|
||
|
|
"observed-data--560a37f3-7eb0-49b9-8ecc-e475950d210b",
|
||
|
|
"url--560a37f3-7eb0-49b9-8ecc-e475950d210b",
|
||
|
|
"indicator--560a37f3-fd30-470d-9130-e475950d210b",
|
||
|
|
"indicator--560a37f3-58c4-4d77-8c81-e475950d210b",
|
||
|
|
"observed-data--560a37f4-2e20-4b5d-bae0-e475950d210b",
|
||
|
|
"url--560a37f4-2e20-4b5d-bae0-e475950d210b",
|
||
|
|
"indicator--560a37f4-08c0-4c99-8e60-e475950d210b",
|
||
|
|
"indicator--560a37f5-8ee0-4e6f-96ac-e475950d210b",
|
||
|
|
"observed-data--560a37f5-43fc-41db-af46-e475950d210b",
|
||
|
|
"url--560a37f5-43fc-41db-af46-e475950d210b",
|
||
|
|
"indicator--560a37f5-863c-45fc-a0b8-e475950d210b",
|
||
|
|
"indicator--560a37f6-2244-4b0f-a827-e475950d210b",
|
||
|
|
"observed-data--560a37f6-cd94-4ace-a0a3-e475950d210b",
|
||
|
|
"url--560a37f6-cd94-4ace-a0a3-e475950d210b",
|
||
|
|
"indicator--560a37f6-06a0-41e4-8a51-e475950d210b",
|
||
|
|
"indicator--560a37f7-72d4-4915-b478-e475950d210b",
|
||
|
|
"observed-data--560a37f7-0cc4-4015-920c-e475950d210b",
|
||
|
|
"url--560a37f7-0cc4-4015-920c-e475950d210b",
|
||
|
|
"indicator--560a37f7-5a4c-437a-9eca-e475950d210b",
|
||
|
|
"indicator--560a37f8-8ae8-4475-9b2b-e475950d210b",
|
||
|
|
"observed-data--560a37f8-9a14-4eee-8dbb-e475950d210b",
|
||
|
|
"url--560a37f8-9a14-4eee-8dbb-e475950d210b",
|
||
|
|
"indicator--560a37f8-51c4-46cc-8e89-e475950d210b",
|
||
|
|
"indicator--560a37f9-f978-4c9b-942e-e475950d210b",
|
||
|
|
"observed-data--560a37f9-5e6c-48da-a5cd-e475950d210b",
|
||
|
|
"url--560a37f9-5e6c-48da-a5cd-e475950d210b",
|
||
|
|
"indicator--560a37f9-2f90-4864-baa4-e475950d210b",
|
||
|
|
"indicator--560a37fa-2694-492b-ae84-e475950d210b",
|
||
|
|
"observed-data--560a37fa-c734-4a75-8e39-e475950d210b",
|
||
|
|
"url--560a37fa-c734-4a75-8e39-e475950d210b",
|
||
|
|
"indicator--560a37fa-3f08-4c83-9a49-e475950d210b",
|
||
|
|
"indicator--560a37fb-ee54-49e6-9300-e475950d210b",
|
||
|
|
"observed-data--560a37fb-3c20-4b6b-b07a-e475950d210b",
|
||
|
|
"url--560a37fb-3c20-4b6b-b07a-e475950d210b",
|
||
|
|
"indicator--560a37fb-df90-455f-943b-e475950d210b",
|
||
|
|
"indicator--560a37fc-4fd0-4ea4-be7a-e475950d210b",
|
||
|
|
"observed-data--560a37fc-e320-415a-8f4d-e475950d210b",
|
||
|
|
"url--560a37fc-e320-415a-8f4d-e475950d210b",
|
||
|
|
"indicator--560a37fd-a2b0-4591-8217-e475950d210b",
|
||
|
|
"indicator--560a37fd-f24c-4868-9f4a-e475950d210b",
|
||
|
|
"observed-data--560a37fd-1d24-4af8-be3c-e475950d210b",
|
||
|
|
"url--560a37fd-1d24-4af8-be3c-e475950d210b",
|
||
|
|
"indicator--560a37fe-a438-4997-a4c6-e475950d210b",
|
||
|
|
"indicator--560a37fe-2d8c-4c9c-acdd-e475950d210b",
|
||
|
|
"observed-data--560a37fe-1d4c-46e8-bed3-e475950d210b",
|
||
|
|
"url--560a37fe-1d4c-46e8-bed3-e475950d210b",
|
||
|
|
"indicator--560a37ff-7774-48ec-bd31-e475950d210b",
|
||
|
|
"indicator--560a37ff-fe28-4087-8296-e475950d210b",
|
||
|
|
"observed-data--560a37ff-e2b8-4ddb-9896-e475950d210b",
|
||
|
|
"url--560a37ff-e2b8-4ddb-9896-e475950d210b",
|
||
|
|
"indicator--560a3800-f0b0-48fd-84a3-e475950d210b",
|
||
|
|
"indicator--560a3800-4eb0-487d-a1e8-e475950d210b",
|
||
|
|
"observed-data--560a3800-7e2c-49f3-bbd9-e475950d210b",
|
||
|
|
"url--560a3800-7e2c-49f3-bbd9-e475950d210b",
|
||
|
|
"indicator--560a3801-014c-421f-95e7-e475950d210b",
|
||
|
|
"indicator--560a3801-8d88-4f63-aada-e475950d210b",
|
||
|
|
"observed-data--560a3801-123c-4461-8ee7-e475950d210b",
|
||
|
|
"url--560a3801-123c-4461-8ee7-e475950d210b",
|
||
|
|
"indicator--560a3802-183c-4851-834c-e475950d210b",
|
||
|
|
"indicator--560a3802-362c-4def-9dca-e475950d210b",
|
||
|
|
"observed-data--560a3802-7438-4c03-adfc-e475950d210b",
|
||
|
|
"url--560a3802-7438-4c03-adfc-e475950d210b",
|
||
|
|
"indicator--560a3803-e34c-447d-949f-e475950d210b",
|
||
|
|
"indicator--560a3803-0518-4660-b992-e475950d210b",
|
||
|
|
"observed-data--560a3803-9e4c-4121-81e8-e475950d210b",
|
||
|
|
"url--560a3803-9e4c-4121-81e8-e475950d210b",
|
||
|
|
"indicator--560a3804-244c-4380-99d7-e475950d210b",
|
||
|
|
"indicator--560a3804-1a64-472f-8a7f-e475950d210b",
|
||
|
|
"observed-data--560a3805-c768-4c66-8364-e475950d210b",
|
||
|
|
"url--560a3805-c768-4c66-8364-e475950d210b",
|
||
|
|
"indicator--560a3805-ac38-45d1-99ac-e475950d210b",
|
||
|
|
"indicator--560a3805-8030-4ab2-9926-e475950d210b",
|
||
|
|
"observed-data--560a3806-ac8c-40f5-856a-e475950d210b",
|
||
|
|
"url--560a3806-ac8c-40f5-856a-e475950d210b",
|
||
|
|
"indicator--560a3806-d234-4950-ae68-e475950d210b",
|
||
|
|
"indicator--560a3806-11bc-4b1d-a14f-e475950d210b",
|
||
|
|
"observed-data--560a3807-1a28-4b90-85f6-e475950d210b",
|
||
|
|
"url--560a3807-1a28-4b90-85f6-e475950d210b",
|
||
|
|
"indicator--560a3807-8d84-4249-8032-e475950d210b",
|
||
|
|
"indicator--560a3807-d4dc-4154-990d-e475950d210b",
|
||
|
|
"observed-data--560a3808-7b48-44e5-9b41-e475950d210b",
|
||
|
|
"url--560a3808-7b48-44e5-9b41-e475950d210b",
|
||
|
|
"indicator--560a3808-9f80-47f3-a4f6-e475950d210b",
|
||
|
|
"indicator--560a3808-26bc-40d2-a164-e475950d210b",
|
||
|
|
"observed-data--560a3809-428c-49ac-8a4a-e475950d210b",
|
||
|
|
"url--560a3809-428c-49ac-8a4a-e475950d210b",
|
||
|
|
"indicator--560a3809-2fec-40b1-96c6-e475950d210b",
|
||
|
|
"indicator--560a3809-9018-4ee0-8ee3-e475950d210b",
|
||
|
|
"observed-data--560a380a-3318-4181-a19a-e475950d210b",
|
||
|
|
"url--560a380a-3318-4181-a19a-e475950d210b",
|
||
|
|
"indicator--560a380a-a870-44a1-a86e-e475950d210b",
|
||
|
|
"indicator--560a380a-3300-4186-93ba-e475950d210b",
|
||
|
|
"observed-data--560a380b-60f8-4159-af62-e475950d210b",
|
||
|
|
"url--560a380b-60f8-4159-af62-e475950d210b",
|
||
|
|
"indicator--560a380b-04b0-41cf-89ac-e475950d210b",
|
||
|
|
"indicator--560a380b-c58c-4f49-94af-e475950d210b",
|
||
|
|
"observed-data--560a380c-f6b4-4a0b-9973-e475950d210b",
|
||
|
|
"url--560a380c-f6b4-4a0b-9973-e475950d210b",
|
||
|
|
"indicator--560a380c-ede8-49b5-af8d-e475950d210b",
|
||
|
|
"indicator--560a380d-0f38-44f5-a277-e475950d210b",
|
||
|
|
"observed-data--560a380d-be28-419e-a4ba-e475950d210b",
|
||
|
|
"url--560a380d-be28-419e-a4ba-e475950d210b",
|
||
|
|
"indicator--560a380d-21ec-4ac1-9ef6-e475950d210b",
|
||
|
|
"indicator--560a380e-e904-49ef-9146-e475950d210b",
|
||
|
|
"observed-data--560a380e-24a4-4476-bedc-e475950d210b",
|
||
|
|
"url--560a380e-24a4-4476-bedc-e475950d210b",
|
||
|
|
"indicator--560a380e-c020-42e1-9501-e475950d210b",
|
||
|
|
"indicator--560a380f-06c4-4fd4-92e4-e475950d210b",
|
||
|
|
"observed-data--560a380f-ad18-44bd-9fe7-e475950d210b",
|
||
|
|
"url--560a380f-ad18-44bd-9fe7-e475950d210b",
|
||
|
|
"indicator--560a380f-2d10-4c50-9f3f-e475950d210b",
|
||
|
|
"indicator--560a3810-fbe0-4196-b434-e475950d210b",
|
||
|
|
"observed-data--560a3810-4334-4cdd-9af2-e475950d210b",
|
||
|
|
"url--560a3810-4334-4cdd-9af2-e475950d210b",
|
||
|
|
"indicator--560a3810-fc64-4a80-aab8-e475950d210b",
|
||
|
|
"indicator--560a3811-7200-4be4-9dbf-e475950d210b",
|
||
|
|
"observed-data--560a3811-4a34-4c92-bf38-e475950d210b",
|
||
|
|
"url--560a3811-4a34-4c92-bf38-e475950d210b",
|
||
|
|
"indicator--560a3811-b3e8-4947-a5a6-e475950d210b",
|
||
|
|
"indicator--560a3812-7f3c-41c4-b6d3-e475950d210b",
|
||
|
|
"observed-data--560a3812-fee8-409c-b074-e475950d210b",
|
||
|
|
"url--560a3812-fee8-409c-b074-e475950d210b",
|
||
|
|
"indicator--560a3812-efcc-4bbb-8c5a-e475950d210b",
|
||
|
|
"indicator--560a3813-888c-4b1f-851e-e475950d210b",
|
||
|
|
"observed-data--560a3813-f354-4ecd-aa07-e475950d210b",
|
||
|
|
"url--560a3813-f354-4ecd-aa07-e475950d210b",
|
||
|
|
"indicator--560a3813-44d8-4b3e-bfd7-e475950d210b",
|
||
|
|
"indicator--560a3814-90e0-4fe0-8721-e475950d210b",
|
||
|
|
"observed-data--560a3814-5788-426d-9d61-e475950d210b",
|
||
|
|
"url--560a3814-5788-426d-9d61-e475950d210b",
|
||
|
|
"indicator--560a3815-ae4c-4e8c-acfc-e475950d210b",
|
||
|
|
"indicator--560a3815-4150-484b-be14-e475950d210b",
|
||
|
|
"observed-data--560a3815-9df8-4e40-8a9e-e475950d210b",
|
||
|
|
"url--560a3815-9df8-4e40-8a9e-e475950d210b",
|
||
|
|
"indicator--560a3816-4508-40d8-8ecf-e475950d210b",
|
||
|
|
"indicator--560a3816-092c-4fce-a85e-e475950d210b",
|
||
|
|
"observed-data--560a3816-da5c-489c-a884-e475950d210b",
|
||
|
|
"url--560a3816-da5c-489c-a884-e475950d210b",
|
||
|
|
"indicator--560a3817-6290-4236-9791-e475950d210b",
|
||
|
|
"indicator--560a3817-ee14-436e-a431-e475950d210b",
|
||
|
|
"observed-data--560a3817-8910-4955-b3ab-e475950d210b",
|
||
|
|
"url--560a3817-8910-4955-b3ab-e475950d210b",
|
||
|
|
"indicator--560a3818-ed70-435a-b376-e475950d210b",
|
||
|
|
"indicator--560a3818-a2f4-4efc-9a8c-e475950d210b",
|
||
|
|
"observed-data--560a3818-8be8-4a89-ad0b-e475950d210b",
|
||
|
|
"url--560a3818-8be8-4a89-ad0b-e475950d210b",
|
||
|
|
"indicator--560a3819-fe54-4b28-9ab0-e475950d210b",
|
||
|
|
"indicator--560a3819-6e84-425d-88a6-e475950d210b",
|
||
|
|
"observed-data--560a3819-2e54-4e24-b79c-e475950d210b",
|
||
|
|
"url--560a3819-2e54-4e24-b79c-e475950d210b",
|
||
|
|
"indicator--560a381a-add8-45f7-9a23-e475950d210b",
|
||
|
|
"indicator--560a381a-5ac8-4fd3-8695-e475950d210b",
|
||
|
|
"observed-data--560a381a-a594-4181-afa9-e475950d210b",
|
||
|
|
"url--560a381a-a594-4181-afa9-e475950d210b",
|
||
|
|
"indicator--560a381b-63dc-456e-9261-e475950d210b",
|
||
|
|
"indicator--560a381b-3f60-4f52-87bb-e475950d210b",
|
||
|
|
"observed-data--560a381b-5e58-4c0a-93bd-e475950d210b",
|
||
|
|
"url--560a381b-5e58-4c0a-93bd-e475950d210b",
|
||
|
|
"indicator--560a381c-77b4-48cb-9f80-e475950d210b",
|
||
|
|
"indicator--560a381c-8824-4d74-a83e-e475950d210b",
|
||
|
|
"observed-data--560a381d-8eec-4645-a5fa-e475950d210b",
|
||
|
|
"url--560a381d-8eec-4645-a5fa-e475950d210b",
|
||
|
|
"indicator--560a381d-6598-455f-9924-e475950d210b",
|
||
|
|
"indicator--560a381d-eedc-4b1f-b724-e475950d210b",
|
||
|
|
"observed-data--560a381e-5094-4198-9626-e475950d210b",
|
||
|
|
"url--560a381e-5094-4198-9626-e475950d210b",
|
||
|
|
"indicator--560a381e-24fc-45d8-8fa9-e475950d210b",
|
||
|
|
"indicator--560a381e-2670-4944-9f20-e475950d210b",
|
||
|
|
"observed-data--560a381f-11ec-4296-bad6-e475950d210b",
|
||
|
|
"url--560a381f-11ec-4296-bad6-e475950d210b",
|
||
|
|
"indicator--560a381f-354c-490c-a3cd-e475950d210b",
|
||
|
|
"indicator--560a381f-3bcc-4d95-87cc-e475950d210b",
|
||
|
|
"observed-data--560a3820-63d4-4104-89b1-e475950d210b",
|
||
|
|
"url--560a3820-63d4-4104-89b1-e475950d210b",
|
||
|
|
"indicator--560a3820-0744-4d05-88dd-e475950d210b",
|
||
|
|
"indicator--560a3820-d6d4-4629-b909-e475950d210b",
|
||
|
|
"observed-data--560a3821-0f0c-42e0-9678-e475950d210b",
|
||
|
|
"url--560a3821-0f0c-42e0-9678-e475950d210b",
|
||
|
|
"indicator--560a3821-50cc-4ec1-9e62-e475950d210b",
|
||
|
|
"indicator--560a3821-4c1c-4cda-b3be-e475950d210b",
|
||
|
|
"observed-data--560a3822-db28-4d07-924b-e475950d210b",
|
||
|
|
"url--560a3822-db28-4d07-924b-e475950d210b",
|
||
|
|
"indicator--560a3822-f850-4097-9430-e475950d210b",
|
||
|
|
"indicator--560a3822-6030-47ef-a35a-e475950d210b",
|
||
|
|
"observed-data--560a3823-725c-488e-9ac3-e475950d210b",
|
||
|
|
"url--560a3823-725c-488e-9ac3-e475950d210b",
|
||
|
|
"indicator--560a3823-66b8-47e0-a552-e475950d210b",
|
||
|
|
"indicator--560a3823-8934-48f9-a298-e475950d210b",
|
||
|
|
"observed-data--560a3824-1140-4c7a-b106-e475950d210b",
|
||
|
|
"url--560a3824-1140-4c7a-b106-e475950d210b",
|
||
|
|
"indicator--560a3824-7154-4bad-9f0b-e475950d210b",
|
||
|
|
"indicator--560a3825-3978-42d1-80ef-e475950d210b",
|
||
|
|
"observed-data--560a3825-0550-4f87-a909-e475950d210b",
|
||
|
|
"url--560a3825-0550-4f87-a909-e475950d210b",
|
||
|
|
"indicator--560a3825-4120-434a-9399-e475950d210b",
|
||
|
|
"indicator--560a3826-abc0-4544-b21b-e475950d210b",
|
||
|
|
"observed-data--560a3826-4434-4a67-928d-e475950d210b",
|
||
|
|
"url--560a3826-4434-4a67-928d-e475950d210b",
|
||
|
|
"indicator--560a3826-f04c-4411-8298-e475950d210b",
|
||
|
|
"indicator--560a3827-984c-408e-a175-e475950d210b",
|
||
|
|
"observed-data--560a3827-2500-4c0d-b367-e475950d210b",
|
||
|
|
"url--560a3827-2500-4c0d-b367-e475950d210b",
|
||
|
|
"indicator--560a3827-a268-4356-bc3b-e475950d210b",
|
||
|
|
"indicator--560a3828-7f88-409f-9920-e475950d210b",
|
||
|
|
"observed-data--560a3828-adb0-42db-82e7-e475950d210b",
|
||
|
|
"url--560a3828-adb0-42db-82e7-e475950d210b",
|
||
|
|
"indicator--560a3828-fa2c-451c-b6d4-e475950d210b",
|
||
|
|
"indicator--560a3829-3ba8-4fe2-a71e-e475950d210b",
|
||
|
|
"observed-data--560a3829-4f44-4603-8ab9-e475950d210b",
|
||
|
|
"url--560a3829-4f44-4603-8ab9-e475950d210b",
|
||
|
|
"indicator--560a3829-844c-4810-80cf-e475950d210b",
|
||
|
|
"indicator--560a382a-a3e0-4a7b-b564-e475950d210b",
|
||
|
|
"observed-data--560a382a-3888-4c7b-b7b3-e475950d210b",
|
||
|
|
"url--560a382a-3888-4c7b-b7b3-e475950d210b",
|
||
|
|
"indicator--560a382a-4d9c-4a4e-b70f-e475950d210b",
|
||
|
|
"indicator--560a382b-05a0-4802-894b-e475950d210b",
|
||
|
|
"observed-data--560a382b-d390-4e71-a061-e475950d210b",
|
||
|
|
"url--560a382b-d390-4e71-a061-e475950d210b",
|
||
|
|
"indicator--560a382b-cf40-478f-b0cf-e475950d210b",
|
||
|
|
"indicator--560a382c-92d8-46e8-85e7-e475950d210b",
|
||
|
|
"observed-data--560a382c-8008-4f5f-849d-e475950d210b",
|
||
|
|
"url--560a382c-8008-4f5f-849d-e475950d210b",
|
||
|
|
"indicator--560a382d-348c-44f3-aafa-e475950d210b",
|
||
|
|
"indicator--560a382d-bc34-4222-bf15-e475950d210b",
|
||
|
|
"observed-data--560a382d-61ec-488d-9e0e-e475950d210b",
|
||
|
|
"url--560a382d-61ec-488d-9e0e-e475950d210b",
|
||
|
|
"indicator--560a382e-93dc-4fa1-9640-e475950d210b",
|
||
|
|
"indicator--560a382e-e8a0-4087-b12d-e475950d210b",
|
||
|
|
"observed-data--560a382e-f660-49c9-9cce-e475950d210b",
|
||
|
|
"url--560a382e-f660-49c9-9cce-e475950d210b",
|
||
|
|
"indicator--560a382f-5b50-472a-9e05-e475950d210b",
|
||
|
|
"indicator--560a382f-c9f8-4ffb-9a5e-e475950d210b",
|
||
|
|
"observed-data--560a382f-d2e4-4f7d-8ed5-e475950d210b",
|
||
|
|
"url--560a382f-d2e4-4f7d-8ed5-e475950d210b",
|
||
|
|
"indicator--560a3830-b6d0-4ec5-96eb-e475950d210b",
|
||
|
|
"indicator--560a3830-52a4-441a-977a-e475950d210b",
|
||
|
|
"observed-data--560a3830-40f8-4372-9e8a-e475950d210b",
|
||
|
|
"url--560a3830-40f8-4372-9e8a-e475950d210b",
|
||
|
|
"indicator--560a3831-12ec-4d41-9370-e475950d210b",
|
||
|
|
"indicator--560a3831-efa8-48b0-adb8-e475950d210b",
|
||
|
|
"observed-data--560a3831-72f4-487a-9a4b-e475950d210b",
|
||
|
|
"url--560a3831-72f4-487a-9a4b-e475950d210b",
|
||
|
|
"indicator--560a3832-524c-4a13-82a0-e475950d210b",
|
||
|
|
"indicator--560a3832-82c4-4650-917d-e475950d210b",
|
||
|
|
"observed-data--560a3832-ae98-4acf-a0f4-e475950d210b",
|
||
|
|
"url--560a3832-ae98-4acf-a0f4-e475950d210b",
|
||
|
|
"indicator--560a3833-b7c8-4bc1-be87-e475950d210b",
|
||
|
|
"indicator--560a3833-74b4-41fe-b8a3-e475950d210b",
|
||
|
|
"observed-data--560a3833-7b88-473b-b7d4-e475950d210b",
|
||
|
|
"url--560a3833-7b88-473b-b7d4-e475950d210b",
|
||
|
|
"indicator--560a3834-3130-427b-8d68-e475950d210b",
|
||
|
|
"indicator--560a3834-a948-493b-ba51-e475950d210b",
|
||
|
|
"observed-data--560a3835-8f38-4458-9913-e475950d210b",
|
||
|
|
"url--560a3835-8f38-4458-9913-e475950d210b",
|
||
|
|
"indicator--560a3835-5794-4492-966b-e475950d210b",
|
||
|
|
"indicator--560a3835-9470-4e49-bbda-e475950d210b",
|
||
|
|
"observed-data--560a3836-8994-4432-bec0-e475950d210b",
|
||
|
|
"url--560a3836-8994-4432-bec0-e475950d210b",
|
||
|
|
"indicator--560a3836-8864-4b06-bb63-e475950d210b",
|
||
|
|
"indicator--560a3836-dcc4-427c-9254-e475950d210b",
|
||
|
|
"observed-data--560a3837-f878-4f75-80e6-e475950d210b",
|
||
|
|
"url--560a3837-f878-4f75-80e6-e475950d210b",
|
||
|
|
"indicator--560a3837-4740-4d71-9086-e475950d210b",
|
||
|
|
"indicator--560a3837-beec-456a-90be-e475950d210b",
|
||
|
|
"observed-data--560a3838-3190-4d2d-85eb-e475950d210b",
|
||
|
|
"url--560a3838-3190-4d2d-85eb-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--56095173-f20c-4e2c-b4ae-e631950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:40:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:40:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "MWI"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5609518e-fc78-4dc0-9ba6-e631950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:41:18.000Z",
|
||
|
|
"modified": "2015-09-28T14:41:18.000Z",
|
||
|
|
"first_observed": "2015-09-28T14:41:18Z",
|
||
|
|
"last_observed": "2015-09-28T14:41:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5609518e-fc78-4dc0-9ba6-e631950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5609518e-fc78-4dc0-9ba6-e631950d210b",
|
||
|
|
"value": "https://nakedsecurity.sophos.com/2015/09/25/microsoft-word-intruder-gets-down-to-business-operation-pony-express/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5609518e-06b8-495a-b184-e631950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:41:18.000Z",
|
||
|
|
"modified": "2015-09-28T14:41:18.000Z",
|
||
|
|
"first_observed": "2015-09-28T14:41:18Z",
|
||
|
|
"last_observed": "2015-09-28T14:41:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5609518e-06b8-495a-b184-e631950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5609518e-06b8-495a-b184-e631950d210b",
|
||
|
|
"value": "https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-microsoft-word-intruder-revealed.pdf"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095217-3874-459f-92e6-47ba950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:43:35.000Z",
|
||
|
|
"modified": "2015-09-28T14:43:35.000Z",
|
||
|
|
"description": "Ammyy",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '07ac3100117511990ce5289f34516bfde0cf8955']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:43:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095223-2388-46fb-86da-4ce7950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:43:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:43:47.000Z",
|
||
|
|
"description": "Andromeda",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6a900d595fa115bc6808891b83043b3b73a8b56b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:43:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095223-a2ec-4926-bcb8-4742950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:43:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:43:47.000Z",
|
||
|
|
"description": "Andromeda",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '88e4462b78bd6a5030fd16b80cbd30446e9c9346']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:43:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095224-77f8-4df8-aa36-43aa950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:43:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:43:48.000Z",
|
||
|
|
"description": "Andromeda",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fac76e87d63d8d9c1d322d110897761ad1c7f935']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:43:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095224-24fc-4b8a-ae07-4d2a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:43:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:43:48.000Z",
|
||
|
|
"description": "Andromeda",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ff6561bebc8b49c342f76153cb6fd2d9d0574a42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:43:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095231-1ce8-429e-9352-4c72950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:01.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:01.000Z",
|
||
|
|
"description": "Badur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fa8ce4947cb443777fa3567232227f19358b2e30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095232-58bc-413e-be09-46c2950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:02.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:02.000Z",
|
||
|
|
"description": "Badur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fa9669f1b70e15decaaf36cf2a35cf3ca7a599d9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095232-8e68-42da-9bbd-418f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:02.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:02.000Z",
|
||
|
|
"description": "Badur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fcabc3269537e4111fa65d35359fa797d5c65778']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609524e-9de8-49b1-8643-4f96950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:30.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:30.000Z",
|
||
|
|
"description": "Bandok",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '22c3a093a23ee698adeaae811028be560acf734c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609524e-928c-40d0-b2e2-4a58950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:30.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:30.000Z",
|
||
|
|
"description": "Bandok",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9510dea35642c327533041a29a3e773c8e3be718']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609524f-2bb4-4bf3-ba46-4488950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:31.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:31.000Z",
|
||
|
|
"description": "Bandok",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd001eda06ebc8e1be0c370efa22127070068b0a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525c-fb58-4523-ac2c-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:44.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0164f765fb7052a8d424f00b171ed07d12ad38c3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525c-3ee8-4eea-a0cf-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:44.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '06fb8253707bfb7407b24329bb1f0bccf1c75f61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525c-85f0-4cb3-a61a-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:44.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '403ec3cc696cc02d4cd3e4b41486228fc4537053']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525d-f044-468d-ac2a-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:45.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:45.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '64b79c92388244a8145bb786ba5f6b7d168fe620']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525d-e6bc-4e1c-bf7d-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:45.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:45.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '733a2ea1e8f4ece7144679b219c510de1c02542e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525d-04dc-4d67-b803-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:45.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:45.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '768eb6f4a75ba132d42ee4ed0a74eb5beb23d9f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525e-81b0-44db-9383-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:46.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '77ba6ecb3b6a3ff17915a1d4f14ab8d2d3d027d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525e-2974-4dfc-834a-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:46.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '783149a773f0aee05474c0f56c778f64133acbb3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525f-7d20-42e7-ba97-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:47.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '79f0612468d8ac28d1ab2792ba9861f2fb6be548']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525f-6dd4-4da7-ad77-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:47.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7dbf34472139d7d4ed21395fcf16d8894254705e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609525f-8cb0-45c5-8c32-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:47.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '87495985394dc1effc83cf56bdbb8413971fcdd7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095260-7b34-4fc8-ac0c-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:48.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '87c2f36393e5232d4a23b555cb233cb81456f4ca']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095260-7d20-464f-8c95-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:48.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '88f5100e446e354201de406730606c865062bd4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095260-cfdc-4ecc-93fe-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:48.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ab91979cf657b563acf9e3576f2b0ec49f57f461']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095261-d640-4df7-baaf-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:49.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ac6d6a5428b08f307cc4c9a52f73ac78d62bc6fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095261-cfcc-43c3-a8cf-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:49.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ad59434e21392a8395924c7919f6d553cddde91d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095261-fcc0-49be-bbbe-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:49.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b00650953c80493ff396ce0b20c59929b898e941']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095262-1f0c-40dd-988b-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:50.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b10405a175b3d5df8810092ab0fec8a6677449f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095262-aff4-4fdd-b10a-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:44:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:44:50.000Z",
|
||
|
|
"description": "Buhtrap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cac0b41ef7eedcd3a8a5f83f7424c426ca05925c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:44:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095272-021c-48e5-846f-4288950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:06.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:06.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '093526b670953023701fbc59973673427dabae7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095273-4398-403b-9d68-421b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:07.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:07.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '192c420744f4fd2fb0d1049669f49a52de5b488b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095273-b440-43c4-92fd-4e12950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:07.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:07.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '20dcea80d03449c7c573efe583cb2ec11962452e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095274-1a18-4265-be55-4460950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:08.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '236bdc316797309b21b466dac2cafb1685b5424a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095274-7060-45db-af09-44d3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:08.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2577ae447809052b671e065472d8f3a92ff4432b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095274-f734-4cf1-9013-4151950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:08.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '25f3ad83db42bfba5704afab906697022f004a2e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095275-c440-48a7-9f67-46c3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:09.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '28e403d40f9f6ef209d983c9bf12c2375e07efe6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095275-8c2c-495d-90b6-4f9f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:09.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2a6067bfc5eefe252af572a516e52cf40c8cf3c5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095276-d39c-4be7-8ba5-441e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:10.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2e52513029f0b164a27ee997d838339e83c74222']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095276-8ee4-4f45-8055-44f0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:10.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '31e9839b2e3b656406faabb7f05fd76a53edea93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095277-8064-4174-b399-4b22950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:11.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '33ffaa455e8f68f1be227ed2d32427fc3c35a20e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095277-cd70-4b44-8139-4327950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:11.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '37235cfae855f41be4128b32d6a7e399325664e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095277-2508-42b6-9470-4e23950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:11.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3d108765da9e451c3800524d0a524ac210c89953']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095278-2140-44fb-9489-4531950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:12.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:12.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3f3a2f8340ef11afcbdda834af2aa8e3a64e94b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095278-3b7c-4220-8076-40ee950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:12.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:12.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '452f039f5d26e047900e8af8b81bb986bea21623']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095279-5268-47c0-9f0a-4913950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:13.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:13.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4a131d65a1c780447606faa509f1ed2ec08771b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095279-c944-4942-9122-457c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:13.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:13.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '56dc3dab580585cac6d1d9efc9d946150c41d5e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527a-a5bc-4bf9-a9d8-4d20950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:13.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:13.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5ddbb11479191be6559ec59809500bb0f8574689']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527a-8258-4e75-aafa-4d93950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:14.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5e2218526b229ab652e0d52bc6c896fa0c7a9e37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527a-a108-47ab-81d3-452d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:14.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5ffa9b2d3358970af8c1681461f4c8fb20b99beb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527b-fbd0-4c3a-868b-4c26950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:15.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6155de110f0d95255cb6fa0bd448fecd4174fed9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527b-0fa4-4f95-8ed0-43dd950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:15.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '636ef7c0e29fa985fa1b2a66488e6ef92bbc5fee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527c-c410-4a1a-8bc6-4ee5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:16.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '678e1ff40c338e7f32d382f414fdd50c5c32df84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527c-ca28-4d7c-b60f-4c07950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:16.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6997dea208c1a9190073e8567e82b282a512298e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527c-0db8-4464-ad95-4aa4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:16.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6c71a3dfa10ea9f815b7a8de3648fa04cca6d86d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527d-f7ec-4365-bb4c-4115950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:17.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:17.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6feee7a522f271aa8340c4a262d6dc342ea96268']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527d-1f88-4b23-9f08-4e75950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:17.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:17.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8bdcac846cac11f40b1e5a5924baad07381f2057']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527e-bb20-4564-873c-4a1c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:18.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:18.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8caf4a2e3b249fa62bedbdb53685432b672976d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527e-4808-4ce9-847a-410a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:18.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:18.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8d58b05fcf96e3063afd1827d6e879ae08f6693b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527f-5d38-4b60-b56c-4b3b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:19.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:19.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9fd58e04ced17f60c1ebfa8b862ab7af18b7984c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527f-8dd4-4718-a463-4eab950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:19.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:19.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a7006a278edcb15e7a01ff98cb22dd425a5ba679']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609527f-5f10-4a55-a06b-433f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:19.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:19.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a741ffda39b6864810d4118fde86f9535f4e0391']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095280-e838-409f-8a57-4b06950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:20.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:20.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a8bf05dba97ef9fbb38ac77c1473e271acef2a75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095280-10b4-4aad-b94f-41fe950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:20.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:20.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a967748f295f16ac2b28521ab2b3efa210eda599']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095281-1488-48c9-80ed-4e14950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:21.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:21.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bf2734a951bbb20e6738ad9c132b9ead0b5873a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095281-6a30-4c6c-bc01-47f0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:21.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:21.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c003a53023eb4aba922784cf52b7c9054a0044f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095282-cc28-46dc-9167-4d7f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:22.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:22.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c04ad61288df9a847311e7f94bf4a9d852d21724']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095282-88e0-4fd4-8046-4ee4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:22.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:22.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c36c11c465120518b8b5818a9cc4e4a31d8d45ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095282-170c-459c-9492-4e0a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:22.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:22.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c3de6b157847c117d2061db6d4a2550991c5c071']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095283-c580-46f7-a77a-418b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:23.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c57f63364cbcf1a3b55feade869911785d1da5b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095283-b478-410a-b842-4aa6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:23.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c64950e0a9fb72ba42ae4f96de84199268b19103']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095284-1454-4c4b-82c3-4a9a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:24.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:24.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c66dacc233dd7df9b76280dd656d88adb25efa4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095284-25a4-4d7c-b235-4c97950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:24.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:24.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd2b20caa1320a208d8ca669e75c6fcb8b82e40f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095284-193c-4f15-8767-4e33950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:24.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:24.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd596194a18da6dfce415f07acca9a3d3f8cd255b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095285-faa4-4dab-95dd-4030950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:25.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:25.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd5d9abd1fe5a229de04efd1ab80fe986f038e4e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095285-e424-47bc-879b-4d2a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:25.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:25.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd71e2ec647b2e6811583d5f156da2d7769694926']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095286-ad44-4646-a1d4-467e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:26.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:26.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd71e310adf183f02e36b06d166f8e3ad54fdbcc9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095286-a708-46c1-bf0a-4057950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:26.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:26.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dbea117606fc7dcdfde00c70e21391ed7f433c73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095287-114c-4abd-b6ab-4ccf950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:27.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e3346a91fce138cbba53b578c6cd514e0f652d84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095287-7764-4ea9-852a-46f0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:27.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f03568dbe213c8d437340f338ddaffee0de6ad8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095287-1b28-4575-9a7f-486a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:27.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f3846775cb68d833370ce836b026e8280aebcc85']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095288-916c-4a18-a100-42d0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:28.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:28.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f94a33bea170934331338e0614eb7106303a4bbe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095288-7dac-4d4f-82cd-4402950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:45:28.000Z",
|
||
|
|
"modified": "2015-09-28T14:45:28.000Z",
|
||
|
|
"description": "Carberp",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fa2fce48d55ad69574317b4a594824144b108c5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:45:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952b7-0c7c-4e6e-bb9e-4ac0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:15.000Z",
|
||
|
|
"description": "Cromptui",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '08b98d597329ad7500b5e0fc2aff9088a1476040']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952b8-b3f0-451c-886d-4e79950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:16.000Z",
|
||
|
|
"description": "Cromptui",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ae5569823536f52e90c0bf38037c339755abc86b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952b8-b5b8-4f47-b137-495e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:16.000Z",
|
||
|
|
"description": "Cromptui",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'aed9a8ed04f468bde9ee6a46f3d9ca002e6fa68b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952c4-12e8-437c-9e47-4810950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:28.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:28.000Z",
|
||
|
|
"description": "CryptoWall",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '59aee2481fcb9f332e10eae4f3a2eb426416a05e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952cf-a318-4c29-ad46-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:39.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:39.000Z",
|
||
|
|
"description": "Delf",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7e5785c49840dd093c3edd8c9aa9a6ede7efb789']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952cf-94cc-48e1-be98-e621950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:39.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:39.000Z",
|
||
|
|
"description": "Delf",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9aab25b9c2cfcadab4b5ad6097eab864782ad839']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952db-5448-4022-b442-4a0e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:51.000Z",
|
||
|
|
"description": "Dofoil",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '806bfe6ec07ae33a457abef400c66b3dee639de9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952dc-12e0-427d-8c05-4ff5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:52.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:52.000Z",
|
||
|
|
"description": "Dofoil",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'af02552de3c5416171eac99929c9e90c06903bbe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952dc-3d74-4bbe-87ea-4d4a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:46:52.000Z",
|
||
|
|
"modified": "2015-09-28T14:46:52.000Z",
|
||
|
|
"description": "Dofoil",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b0dabad6620c51ff033a95b2ba33159b30300fc6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:46:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952e6-2c94-43dc-a0e4-4f18950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:02.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:02.000Z",
|
||
|
|
"description": "Dyreza",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5b767e871485983c7c2c17cb8590cc2862d2a114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952e6-4be8-4087-b286-4f18950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:02.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:02.000Z",
|
||
|
|
"description": "Dyreza",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd86a1e65fef99f9ac75185d25ba0a318d25eaf95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952e7-866c-431f-a95f-48a9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:03.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:03.000Z",
|
||
|
|
"description": "Dyreza",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e9500ba8ee71d28a85fe375fb1859e32a62e5d8b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952f2-9328-4511-b9fa-4d4e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:14.000Z",
|
||
|
|
"description": "Dyzap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2c378afb16742b138f8e5f35887687f98a3bfc14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952f3-d320-4688-9c81-4a85950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:15.000Z",
|
||
|
|
"description": "Dyzap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7bb6ea632a9944ee90fc2714a362c19451ea0e36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560952f3-513c-443c-a882-4482950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:15.000Z",
|
||
|
|
"description": "Dyzap",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b08f351c228ff246d29f548ef910fe6e58c83caf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095300-0458-4dc4-973c-468e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:28.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:28.000Z",
|
||
|
|
"description": "Evotob",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '40df05a0a872f92371ea315af786746d84342837']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609530d-013c-486f-9861-4587950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:41.000Z",
|
||
|
|
"description": "Fsysna",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '96ed7a1071595ccd96b1ab7bd7fbb751262ef1ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609530d-b240-401f-bd12-4ccd950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:41.000Z",
|
||
|
|
"description": "Fsysna",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '97b22531422950658c06e6412a8670a2e6971bd1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609530d-8894-4ff1-8ca6-44ad950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:41.000Z",
|
||
|
|
"description": "Fsysna",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '99ba488f515ce4837dadfee6ea99c0d85a27095c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609530e-ceb8-49ed-94a7-4897950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:42.000Z",
|
||
|
|
"description": "Fsysna",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9d6d9fc05ce8e386113b971d8f4c8612832e8e48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609531c-69f4-4f1d-8e65-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:56.000Z",
|
||
|
|
"description": "Gamarue",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8e0a25c8394d66a10f86b06fc0b2d6a738e8f1b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609531c-d024-4dd9-92da-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:56.000Z",
|
||
|
|
"description": "Gamarue",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '92f8ae6e382e8505154f35bfcc540a8393d79648']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609531d-0e90-416e-9c22-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:57.000Z",
|
||
|
|
"description": "Gamarue",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9331eadbe9fe620f2b6232cb79ddc83457e49653']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609531d-dcdc-4bee-b6a2-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:47:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:47:57.000Z",
|
||
|
|
"description": "Gamarue",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '93e5d0166a32ec616cdb66a9ae68cc1b0799e2a6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:47:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095329-4fcc-4561-ba1c-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:09.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '038edf0b0bc3faec0c9c8c291fd9f1ac509383d1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095329-6110-4df1-8e16-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:09.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '05468cb85b2ef4f63ffc2256414eb984315e7600']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532a-a93c-4f07-97b3-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:10.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '27f59ac9b5796b46bb13cf9dc85bb5e8893a96d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532a-6b84-4ea2-95a2-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:10.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '343b3546cff0b52065b354e24a8370b65874f8a1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532b-9dc0-436c-967a-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:11.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '386d40d972a74729d20d6e95b6ab5ffd4c8b7bec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532b-b160-44e9-8659-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:11.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '3b6efeb322fc464086e7daaa54398ac1ceef4bff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532c-13c0-4401-94af-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:11.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:11.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '54b8085a371d63eba486136730d1c3ad303c3693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532c-ebbc-47e9-b15c-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:12.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:12.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5cc410e31e5e84e980039e99cae47cbabae85a5c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532c-6058-4612-a02e-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:12.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:12.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6457c9efabaefee75ba950f7c93d89f921b22663']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532d-d304-424c-b1b2-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:13.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:13.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '80ac4199c7c519cbbcc04087a684b776cfe2b24a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532d-5308-494b-a517-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:13.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:13.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '8afd513d177f99fe4ef95ba5a26c009f9e48b637']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532e-a0a4-4339-ba57-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:14.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9aa2372ebaac689c503a07a693a305aa845539b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532e-57cc-4276-a8c0-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:14.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b724a030ef3d3ca5aacba76c11bbeb72193f7558']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532e-bcbc-4ee9-82f8-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:14.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:14.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bb33f094b2f9c940b25518efcb9eb1dc38612be8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532f-7410-4e71-9223-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:15.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bbb7e5d092f7e4a56cf0be51d1c586c61f63f44d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609532f-1c30-4b4f-8637-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:15.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:15.000Z",
|
||
|
|
"description": "Heye",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c17f283852e9054c5a99fab2ced81dcdb7717ae0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609533b-f6c4-42ed-92b2-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:27.000Z",
|
||
|
|
"description": "Kasidet",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4da12a7730301073ab634b6a597a0d9c3902447d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609533b-81b0-4f55-80ab-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:27.000Z",
|
||
|
|
"description": "Kasidet",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b9464ea94140dbacceda95256d2c8de7baf2b3b1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095345-069c-48b4-a23a-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:37.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:37.000Z",
|
||
|
|
"description": "Kazy",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '09c407767dee6a62b2f749ad42237a743d7041d0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095346-1174-4cdc-ad5c-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:38.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:38.000Z",
|
||
|
|
"description": "Kazy",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1633ae5ff2e74118806e2a73d3e3c5445283fb01']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095346-c6b8-44d2-8fcb-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:38.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:38.000Z",
|
||
|
|
"description": "Kazy",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '18e0c75baa79355d24015acab0a6225bf9f75880']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095350-80ac-4c07-857d-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:48.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7d9035f66cd2bc7a1357954410b70e885c5527ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095350-ea64-479d-9685-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:48.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9c8474f8c7e87328573c822cb73014117e32a633']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095351-02ec-4ba7-abe4-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:49.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b843d5781a55532e99d55ee03c23cc6342f121ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095351-81c4-4c70-adbc-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:49.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e01bf8c25aacdb56a460f01832c0a0285a17949f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095352-a720-4896-ba6d-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:50.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eaf648a422b2edf0184af296845be8bbf0d8fc6d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095352-3e78-43cb-9445-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:48:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:48:50.000Z",
|
||
|
|
"description": "Limitail",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f8e53b776d0eee4f824eaa3cdb1b0b1bb186437d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:48:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095363-9ea4-41a6-8f74-43dd950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:07.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:07.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6e414d26146d9e33c690f9e482c59b87184575f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095364-1f30-4c62-bf67-47f0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:08.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '93ebf964c992148672861adcc49b88096476a516']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095364-5098-4182-bed0-4b76950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:08.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9e3b077293bebc745ed3b3b4bf6d7916f1a609db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095364-98c0-4b91-8cbf-4a66950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:08.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a0124d2b3d9e1a7bb79a5f590bd00e24eb6662ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095365-f68c-486e-9a02-49b4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:09.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c8f3087c1a5ea390fab3e0e6124734f69367d5d7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095365-589c-4fac-8dbe-4655950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:09.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c931c0a9e689fad266dc2d3d10b1f5d81f642eba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095365-1eac-4537-8cab-4fc6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:09.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:09.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ee10d8d24d627a4251be10d8958f9b74b104b7d4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095366-b250-47a6-86a8-4d32950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:10.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fe351e852c74170cac5ab3271e4da55eb413ad02']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095366-3014-4975-b747-48a9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:10.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:10.000Z",
|
||
|
|
"description": "NetWiredRC",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fe8c933d0ad848cce6f05566146b28dc914cd9cd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095386-396c-4502-8b32-4508950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:42.000Z",
|
||
|
|
"description": "Omaneat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bde3bdfeb2c539be5ee4f68130df8206a3324e0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095387-e1b0-4cd3-8827-4062950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:43.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:43.000Z",
|
||
|
|
"description": "Omaneat",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e2021957bcd4021aa1cf0504fd065b9d575ca333']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095393-0e04-4ea4-8671-4b11950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:49:55.000Z",
|
||
|
|
"modified": "2015-09-28T14:49:55.000Z",
|
||
|
|
"description": "Peaac",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f736dbf5941dcd4455a396cfce5444d21f922c71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:49:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953a0-a1e8-4e47-9f08-4c3e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:08.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:08.000Z",
|
||
|
|
"description": "Ransom",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e444378c08984b8c8089bd6d2328c4f2edc2ee2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953aa-fbc8-4abd-b5b2-475b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:18.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:18.000Z",
|
||
|
|
"description": "Repezor",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'be4eb726c8dd8b554e143816b739cbddf9fcf9fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953b3-82b8-4cc8-b623-4007950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:27.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:27.000Z",
|
||
|
|
"description": "Rovnix",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cf4d668c6e0f7912c13ce2b73add4972bc3d6f4e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953c1-6ed8-4d18-b9c0-4ea6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:41.000Z",
|
||
|
|
"description": "Sekur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '13523cfce0c813a571534ae1f447d8887efa40ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953c1-a8d4-4cea-a044-4146950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:41.000Z",
|
||
|
|
"description": "Sekur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eb5735cc503260fa583004b6643f704d441d05ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953c1-d018-4d73-8aa1-4e70950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:41.000Z",
|
||
|
|
"description": "Sekur",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ec4615aaaff5d786ea7e9640ead158f0a84f2674']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953d0-763c-4161-868a-4af4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:56.000Z",
|
||
|
|
"description": "Sheldor",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '94efad86fc7439b8fdfe4cd2fc8d0b3433f67809']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953d0-63b4-4f0b-bcaf-4e29950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:50:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:50:56.000Z",
|
||
|
|
"description": "Sheldor",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f8faa7149d2a35206ab3bace2673447014ac2b1a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:50:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953e4-92d0-43a2-8ca6-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:16.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:16.000Z",
|
||
|
|
"description": "Sopinar",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b6a482779df4e6ef7e5bcec4675f396002ad7662']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953f2-0604-4d52-9a1a-48d5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:30.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:30.000Z",
|
||
|
|
"description": "SpyGate",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0ed093948ab56f7b7f35efd4418523fb265d50e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953f3-fb78-4a9d-9921-4c33950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:31.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:31.000Z",
|
||
|
|
"description": "SpyGate",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '785d0c848124c23895fc62e45c9e61eabb3170c3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560953fe-5f34-4805-bf80-4990950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:42.000Z",
|
||
|
|
"description": "Staser",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2a4d4c699fb34a31ab2b5f8a67735ec3093aa2c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095407-7e5c-4e8a-8843-475d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:51.000Z",
|
||
|
|
"description": "Throwback",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1571d05e37f7bf6c7f2d5930c3c17c6cbb1ef78e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095407-cba4-4d2d-be65-48da950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:51:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:51:51.000Z",
|
||
|
|
"description": "Throwback",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6d1d0dde5aa796e0be18577bfdbb81bd6c9b2dcb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:51:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095413-315c-474f-85bd-473e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:03.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:03.000Z",
|
||
|
|
"description": "Tinba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '68ceae9ccb80f79aba58a1964b2946ee543fb541']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095413-0dbc-4e6c-b7a8-4b3b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:03.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:03.000Z",
|
||
|
|
"description": "Tinba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a4adf95a2f0cf230a388fb653d371e4ab3e0388f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095414-84c8-484f-9518-4b5b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:04.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:04.000Z",
|
||
|
|
"description": "Tinba",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c7d5061a697f9932af2b61f6eb01f2a80398b161']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095426-dcd4-4cf1-aea8-4593950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:22.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:22.000Z",
|
||
|
|
"description": "Toshliph",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7162bb61cd36ed8b7ee98cbd0bffec33d34dd3e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095427-6088-44f7-8280-44f3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:23.000Z",
|
||
|
|
"description": "Toshliph",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '81e43d653acd2b55c8d3107e5b50007870d84d76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095427-6a74-4ec7-b662-41a3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:23.000Z",
|
||
|
|
"description": "Toshliph",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ac68ad2e5f5802a6ab9e7e1c1ec7fab3c6bdbaa4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095432-40a8-4149-ab3a-4956950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:34.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:34.000Z",
|
||
|
|
"description": "Trontoz",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5517896a2e9dff5db6394b9af2542c191bf1f07c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095432-7df4-4f39-8370-4e60950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:34.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:34.000Z",
|
||
|
|
"description": "Trontoz",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '563f20c755dfd43840de7c060cf653395c9f3c61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095433-ba08-4371-ad12-45c7950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:35.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:35.000Z",
|
||
|
|
"description": "Trontoz",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5673a1e6b04cd77ee613903191c21f6db5c38dc6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095433-ad44-4b4e-b30a-4008950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:35.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:35.000Z",
|
||
|
|
"description": "Trontoz",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'acacf20479c47c76550c82f8ff583ee75a092c6c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609543e-1d70-4d79-bcc3-40e4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:46.000Z",
|
||
|
|
"description": "Vawtrak",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4ec7f0703c33be891027492571b1bf2585da3d30']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609543f-87b0-4f63-9ce5-415d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:47.000Z",
|
||
|
|
"description": "Vawtrak",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '53ebd50f65b0c41d199451ef7b667cd5628c0947']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095449-4184-4550-818f-4532950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:57.000Z",
|
||
|
|
"description": "VB",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0b382fb11442c893eeafd2774f3716f5163d4400']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095449-b190-48f4-bf6e-4c46950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:52:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:52:57.000Z",
|
||
|
|
"description": "VB",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '92f18ea77d533735f1f0c54e81aa6bbf3746c96b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:52:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095458-c420-4968-a0d1-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:12.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:12.000Z",
|
||
|
|
"description": "VBSFlood",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cf164075d6a7270c518bb9a860c75c7e688d5e8b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095463-af20-48b3-9212-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:23.000Z",
|
||
|
|
"description": "Wauchos",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1195c4627be54f26b29d0dc56752d233547ff6a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095463-9470-4c74-bb23-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:23.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:23.000Z",
|
||
|
|
"description": "Wauchos",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '2de039f70be6062201bb1d890a510730009c429a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095464-bc18-4ac0-bdda-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:24.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:24.000Z",
|
||
|
|
"description": "Wauchos",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4edb139f6d459f3a7dd31abba29a4c6c3046072f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095464-f26c-4db0-8248-e0ac950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:24.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:24.000Z",
|
||
|
|
"description": "Wauchos",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e7fde2d37367618397ae1f064f2837b22a74a2bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095472-c0a0-4618-838a-42da950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:38.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:38.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '03062e13fa18d1fbf3ceb9af8066d44be14b1a98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095472-40e8-410a-b439-4ab3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:38.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:38.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '06e15e42d9afbc5fa60f550a4e05d8465ac97962']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095472-1a9c-42ee-a2af-42a0950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:38.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:38.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0836e191a3acc68691678da93b27a4647ed0b81a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095473-6254-46b2-95fe-46a9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:39.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:39.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '0d3cd2a3f96ef987d1c573a93e22aac2960f3e8f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095473-c424-4ecb-8594-417c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:39.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:39.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1716a5e070d4dd894f9fe3c275f9eb0cf2f7366e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095474-fa68-42c4-9d51-45e9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:40.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:40.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '19cc1c2c632e885456d574e91bc6fefb78969337']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095474-2480-423f-aa50-4668950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:40.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:40.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '236601366984731026238957f79b47540be87d31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095474-efe8-4362-a412-43f3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:40.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:40.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '400631fecfc435a47578d482471bc4817ae4dc81']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095475-1438-40a8-b6c2-480f950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:41.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '40d4dfdba734483dbf3119a9cd3531086e6aba00']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095475-2dbc-4581-9e54-4fae950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:41.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '489f70efbcbcaa6534185de0abd02dd5f128d11d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095475-8238-41c7-94b1-4b35950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:41.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:41.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '491d7a0b8136bad5f115a2af2ae8737ad9b4d2ec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095476-6830-4093-b2a1-4bdf950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:42.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4ad5e80794532928d5faa72af68a33fa3d1ab587']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095476-3404-4605-85d0-40a3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:42.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '58560676784e5d122293661f7c81eeb12dd1e641']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095476-f74c-4032-b53b-4aaa950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:42.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:42.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '59f0119085ada628e01e57b04bc17d6a8def167f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095477-a4a0-4bf7-951e-4e9d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:43.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:43.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5b513e490334e82b066c4392626efed35a641b93']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095477-6b40-4887-987c-4d4c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:43.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:43.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '5be3f8bd1de43f3325865a887d654e97097353ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095477-6e2c-416e-a5aa-4bbc950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:43.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:43.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '61e72119d993cab21cba481e1ffb6f9f46fa55f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095478-58f8-4827-9985-4124950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:44.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '626b550c9c53c515d63de0aa3f84dfdb4aa546ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095478-afe0-47aa-8db7-4fda950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:44.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6c8cd7f5e7ffb65432f07e9e1c5d6d244984021b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095478-0ee8-4bb1-a0d8-4361950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:44.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:44.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6d8b71c453b0712fa5d0e02fc1ba6093d8b9237c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095479-007c-4fbc-805d-48fe950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:45.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:45.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '7bf7ee5762f06310506d32995f273fc74f4c6af5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095479-918c-4245-b15c-4aca950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:45.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:45.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '896fe4edc6ca4a29da0eaf11a2aac1e3a367dced']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547a-d8d0-447b-9d6b-46a8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:46.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9908a0ff6b4f25d8ff48a82dae9d22a20a2339ad']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547a-4470-4d70-88a7-46b3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:46.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9a19934f052b1adaeb94ff09b6a7183c8a8b5c9a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547a-89fc-4439-85c8-4735950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:46.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:46.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9a9f5e2d3778cea8b9a47dea4cbaf7d58b60e6ee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547b-4f48-4d27-b1f9-4e1a950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:47.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a53b49df105cdaa1ae686f819473eddc2254e211']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547b-69a0-4b5f-9dcf-4405950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:47.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ada48cc91ceb53167b64b877f02d6157d18e6c98']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547b-6de0-4d35-83fe-46ba950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:47.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:47.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b507502ef38d407661b17a788f961ee4ed73a0b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547c-8b2c-438b-a74c-42e8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:48.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b9e43fc603f1e30b27f23bce88dbe6cdbc16d5b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547c-3290-4bd6-a406-46ae950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:48.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ba6e79b17d6a36fc465aa5ff2857f50016e09b9b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547c-8bd4-4ee9-b098-4f04950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:48.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:48.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bab55e333ea120f34ae1d8f21f5f1fcbb8a7565f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547d-f370-4759-a0cb-4733950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:49.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'bd620bef8d9ecf79f4308b4f10f54d7e67ed7d78']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547d-6600-4ff1-8ad2-4160950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:49.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c3a7cb43ec13299b758cb8ca25eace71329939f7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547d-0c64-4693-82bf-4f40950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:49.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:49.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c8d869b14c50218ce018ca594ec824afc63fbb77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547e-aa94-448f-83a8-40e1950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:50.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c90dcfb585193e1caf600d38cf1ac8f6256f5d57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547e-73f8-436f-b7db-4821950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:50.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c9a14c7bf9b62771388277d5616f3be48fa70e4a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547e-4c14-47e1-bf70-49b6950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:50.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:50.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cb1e0f4474a95e1e69873a173ff9e8b4cd2350ce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547f-bccc-4d1d-adff-4f7e950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:51.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cc83526d7dd4fc090b36bd34d47a9849f3e19880']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547f-8200-4e8b-9ff9-404b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:51.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cd916216aea8e27cabd77cbc967277d059d56f5f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5609547f-7ea4-40b1-ab83-42a5950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:51.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:51.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cddac70af46e911fa463ef55f845efe85f7f0368']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095480-0b70-426f-849e-4460950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:52.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:52.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cf1cbe1829af40b57aa236db95c08fed2e5b9b9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095480-dd30-44cd-92bc-47e9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:52.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:52.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cf2908199eea4692466fb80f1184d59ae1f6ab20']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095480-c7ec-4937-8214-48c7950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:52.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:52.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'd12248136757a0522d5f9b6a5b92453f1e2f8cf4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095481-02f4-4968-b23d-4ef9950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:53.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:53.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'dc8b44d90e61ea49085ed4e836ddf5dd857c98cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095481-beac-43b8-ab9c-49c8950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:53.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:53.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e3f41c5b1820e8e0d4c0bcedb246236b3b8e77d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095482-ecc4-4e21-9e56-471b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:54.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:54.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e661dbc9a0ba1dc4510b2d39fb1cdc2e1994fa99']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095482-46e0-42f4-bd67-4daa950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:54.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:54.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e7e2eafda7f92789f92a9c5ad3004a87051d7841']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095482-de28-42e4-a34d-4605950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:54.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:54.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eaece389f049efcecc1e01af590e589c6e8197ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095483-fc18-4e8f-8713-4ae3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:55.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:55.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'eb67b16b8042545cc0daa3650be2b7110f4899b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095483-ec4c-4945-8ee1-4a53950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:55.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:55.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'ef4fb64e5df64aebdb4acde630279e63ccb2d354']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095483-87bc-4889-a286-4337950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:55.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:55.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f0286cde9eaca6a6fc17aa1cf3e06d59fe0d6abd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095484-02b8-47a7-a9c8-494b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:56.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f45f9ae8f59913eda95983e1a5af64aff1d6b840']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095484-79b8-4616-901d-42a4950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:56.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f45ff1cbd30a527e3c99ff25774fc269e897e6d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095484-1750-4ac1-b8d4-4447950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:56.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:56.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f8aa6106545409c909a076a817a74d57f34cd0fd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095485-f158-41ed-8f52-4f5c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:57.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f939d2566c9856c94d0a54be80fce147890bc861']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095485-b46c-44b9-a2fa-4f51950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:57.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fbd733b18398934ea4db5803410ebff31512990a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095485-b988-4918-aa05-4d7b950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T14:53:57.000Z",
|
||
|
|
"modified": "2015-09-28T14:53:57.000Z",
|
||
|
|
"description": "Zbot",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'fe6e9480f5c91749b48248e808dfa52e2f394e0f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T14:53:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560955f5-9244-4807-8d18-414c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T15:00:05.000Z",
|
||
|
|
"modified": "2015-09-28T15:00:05.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '72ad8436a10eb18e3a65a3bc85380ee165ea29b4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T15:00:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560955f5-ce24-4374-bc31-4a2c950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T15:00:44.000Z",
|
||
|
|
"modified": "2015-09-28T15:00:44.000Z",
|
||
|
|
"pattern": "[email-message:body_multipart[*].body_raw_ref.name = 'VAT Returns Repot 588270334.doc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T15:00:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560955f6-0e2c-4551-ad43-4cd3950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T15:00:06.000Z",
|
||
|
|
"modified": "2015-09-28T15:00:06.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'b6d03b9cb1c527989e32136efe0be00b456c658c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T15:00:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560955f6-59d4-460d-9334-473d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T15:00:58.000Z",
|
||
|
|
"modified": "2015-09-28T15:00:58.000Z",
|
||
|
|
"pattern": "[email-message:body_multipart[*].body_raw_ref.name = 'digest_09_10Jun2014.doc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T15:00:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"email-attachment\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56095689-af1c-4442-a640-498d950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-28T15:02:33.000Z",
|
||
|
|
"modified": "2015-09-28T15:02:33.000Z",
|
||
|
|
"pattern": "[network-traffic:extensions.'http-request-ext'.request_header.'User-Agent' = 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; Infopath.3; ms-office; MSOffice 14)']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-28T15:02:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"user-agent\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3740-f244-4679-983f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:20.000Z",
|
||
|
|
"description": "- Xchecked via VT: 72ad8436a10eb18e3a65a3bc85380ee165ea29b4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c6bdbe23857c0ca054d9fbc07f53ee0187b5ab6e86fea66091171e5b4268cb25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3741-19a8-442c-9a82-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:21.000Z",
|
||
|
|
"description": "- Xchecked via VT: 72ad8436a10eb18e3a65a3bc85380ee165ea29b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f49ba87bdcbb24ecf22f9b5b3a8c2a34']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3741-8570-4787-97c1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:21.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:21Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3741-8570-4787-97c1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3741-8570-4787-97c1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c6bdbe23857c0ca054d9fbc07f53ee0187b5ab6e86fea66091171e5b4268cb25/analysis/1441256822/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3742-4ed0-4757-903b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:22.000Z",
|
||
|
|
"description": "- Xchecked via VT: b6d03b9cb1c527989e32136efe0be00b456c658c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '40f335d26c1b7b207f533ccc88a37d23b20235a6a8ad46ac293913938dee31e9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3742-6a20-4db5-8ba2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:22.000Z",
|
||
|
|
"description": "- Xchecked via VT: b6d03b9cb1c527989e32136efe0be00b456c658c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ef8edf1719ab183f1f579ba2b223a523']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3742-4944-49f7-b8d7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:22.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:22Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3742-4944-49f7-b8d7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3742-4944-49f7-b8d7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/40f335d26c1b7b207f533ccc88a37d23b20235a6a8ad46ac293913938dee31e9/analysis/1441256798/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3743-aa30-4b16-abde-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:23.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: fe6e9480f5c91749b48248e808dfa52e2f394e0f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '299b7fb61851adea8bb4b1b6c66386b072528afbc8de50d902cdd7d8812690eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3743-f574-4469-8146-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:23.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: fe6e9480f5c91749b48248e808dfa52e2f394e0f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07429b0f3cedf67947745140cd565cec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3743-0de8-4570-aafa-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:23.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:23Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3743-0de8-4570-aafa-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3743-0de8-4570-aafa-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/299b7fb61851adea8bb4b1b6c66386b072528afbc8de50d902cdd7d8812690eb/analysis/1438701989/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3744-dd48-42c4-b5f8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:24.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: fbd733b18398934ea4db5803410ebff31512990a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cd60c07c73e264cc7b1c2ccb15295517f198c959fe04ba4a5230b1774dac1ce1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3744-e8f0-42b0-8904-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:24.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: fbd733b18398934ea4db5803410ebff31512990a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '022232906b3593f51905a8bcb1fef25f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3745-c61c-499c-adf1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:25.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:25Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3745-c61c-499c-adf1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3745-c61c-499c-adf1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/cd60c07c73e264cc7b1c2ccb15295517f198c959fe04ba4a5230b1774dac1ce1/analysis/1432904681/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3745-68a8-4eac-b516-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:25.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f939d2566c9856c94d0a54be80fce147890bc861",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4182165c4ef9455bc02617ca0c683bf4a546cb99f364cb533ac1ac04bfd4f03d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3745-e2d4-439e-9114-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:25.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f939d2566c9856c94d0a54be80fce147890bc861",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e56e87cbb2c43a0bb01f7d422642d7ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3746-7194-4e35-8ac4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:26.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:26Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3746-7194-4e35-8ac4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3746-7194-4e35-8ac4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/4182165c4ef9455bc02617ca0c683bf4a546cb99f364cb533ac1ac04bfd4f03d/analysis/1442837937/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3746-1db4-4037-9f21-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:26.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f8aa6106545409c909a076a817a74d57f34cd0fd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '215d164ffc3d1a2df3669c042dcdfc8aa0d5916c0b94be9972f2cdbdbddc967d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3746-09c0-46cd-ac56-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:26.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f8aa6106545409c909a076a817a74d57f34cd0fd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '718facfd6be624a5def445932957b1d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3747-d270-48a7-a20f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:27.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:27Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3747-d270-48a7-a20f-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3747-d270-48a7-a20f-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/215d164ffc3d1a2df3669c042dcdfc8aa0d5916c0b94be9972f2cdbdbddc967d/analysis/1441216997/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3747-6248-4483-a0cb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:27.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f45ff1cbd30a527e3c99ff25774fc269e897e6d8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '615f49edf7f906b9ce815fc91d4b23b3231d28403f0a4e5795bfcb1ded929f05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3747-7dfc-408b-8e4c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:27.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f45ff1cbd30a527e3c99ff25774fc269e897e6d8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '603f1fcb9897e8aaf8becfc6127d40a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3748-c2a0-4f17-852d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:28.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:28Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3748-c2a0-4f17-852d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3748-c2a0-4f17-852d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/615f49edf7f906b9ce815fc91d4b23b3231d28403f0a4e5795bfcb1ded929f05/analysis/1441347570/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3748-ac34-4769-a090-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:28.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f45f9ae8f59913eda95983e1a5af64aff1d6b840",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '44c27df9eb7234760e8e14548e91e89c8e758472179f783f6e97cfffbea032a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3748-7d48-4672-b71e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:28.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f45f9ae8f59913eda95983e1a5af64aff1d6b840",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2f38e449c4fd1dafc538a8f9d8e4cb6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3749-c4d8-4904-b36b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:29.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:29Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3749-c4d8-4904-b36b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3749-c4d8-4904-b36b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/44c27df9eb7234760e8e14548e91e89c8e758472179f783f6e97cfffbea032a8/analysis/1441347243/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3749-38dc-444e-a36b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:29.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f0286cde9eaca6a6fc17aa1cf3e06d59fe0d6abd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd247857069e411bc4a1db6855b5b4f5cb2abe40785932843bf49e8eb5479de62']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3749-9748-4013-a267-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:29.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: f0286cde9eaca6a6fc17aa1cf3e06d59fe0d6abd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a2b4bc0943fc7465c85a5b4688cda8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374a-f41c-4510-8b69-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:30.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:30Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374a-f41c-4510-8b69-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374a-f41c-4510-8b69-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d247857069e411bc4a1db6855b5b4f5cb2abe40785932843bf49e8eb5479de62/analysis/1441347984/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374a-dba0-42ae-842b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:30.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ef4fb64e5df64aebdb4acde630279e63ccb2d354",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ee205f4721a6eca0c59e6a2e54aede92a60b3f4b88d821082a0e15e42c1a1f05']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374a-1cb8-4eb4-bc7c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:30.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ef4fb64e5df64aebdb4acde630279e63ccb2d354",
|
||
|
|
"pattern": "[file:hashes.MD5 = '21b72ae0d275d0e6b5e0bedc2321b90f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374b-e1b0-45ca-aa57-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:31.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:31Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374b-e1b0-45ca-aa57-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374b-e1b0-45ca-aa57-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ee205f4721a6eca0c59e6a2e54aede92a60b3f4b88d821082a0e15e42c1a1f05/analysis/1441347921/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374b-26a8-4477-b159-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:31.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: eb67b16b8042545cc0daa3650be2b7110f4899b4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3c98d1149db8229c402b11cf067d03bca191efcf6e77ee4981d81a82a24a4a5c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374b-35e0-4f33-9318-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:31.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: eb67b16b8042545cc0daa3650be2b7110f4899b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '42287f9b1256e717702757d8ba798b89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374c-8660-4b00-bb23-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:32.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:32Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374c-8660-4b00-bb23-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374c-8660-4b00-bb23-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3c98d1149db8229c402b11cf067d03bca191efcf6e77ee4981d81a82a24a4a5c/analysis/1441347098/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374c-28a8-49da-89ed-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:32.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: eaece389f049efcecc1e01af590e589c6e8197ea",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '033390d0e4b0b2b348a6a80af2d6a919d283b9785b4cdcf4c9d79134ff0dbbec']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374d-49f8-4e42-ad20-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:33.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: eaece389f049efcecc1e01af590e589c6e8197ea",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cca7d6414bdf97fadb4d922a909efb0c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374d-f51c-4350-9e8d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:33.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:33Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374d-f51c-4350-9e8d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374d-f51c-4350-9e8d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/033390d0e4b0b2b348a6a80af2d6a919d283b9785b4cdcf4c9d79134ff0dbbec/analysis/1441347498/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374d-8a10-488c-b3f2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:33.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e7e2eafda7f92789f92a9c5ad3004a87051d7841",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8f13740b886196e23e81ff48e7ca6ed5598ae715566f6a37d5f3343d023640fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374e-f9a0-4ec0-932b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:34.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e7e2eafda7f92789f92a9c5ad3004a87051d7841",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6fd76a599ba19524979af626653f6be3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374e-3838-473a-8c94-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:34.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:34Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374e-3838-473a-8c94-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374e-3838-473a-8c94-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8f13740b886196e23e81ff48e7ca6ed5598ae715566f6a37d5f3343d023640fc/analysis/1440680495/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374e-8618-4a90-89ed-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:34.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e661dbc9a0ba1dc4510b2d39fb1cdc2e1994fa99",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b1ae7745a6058194ddc021b82a5babbbc5f53b01ff4605e1ef3f8cfc438e895']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374f-4680-488b-9f8b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:35.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e661dbc9a0ba1dc4510b2d39fb1cdc2e1994fa99",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a0518c11f630e2d37fd7d8db85aa809c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a374f-3798-4140-8e9f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:35.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:35Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a374f-3798-4140-8e9f-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a374f-3798-4140-8e9f-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5b1ae7745a6058194ddc021b82a5babbbc5f53b01ff4605e1ef3f8cfc438e895/analysis/1441216994/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a374f-1e50-4a16-a8dc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:35.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e3f41c5b1820e8e0d4c0bcedb246236b3b8e77d2",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0fd1cbd75db3ca0580105f404138c3ca4b4faace6cf999a706fa1b4dec81a6fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3750-6380-448b-bee6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:36.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: e3f41c5b1820e8e0d4c0bcedb246236b3b8e77d2",
|
||
|
|
"pattern": "[file:hashes.MD5 = '31ddf61874a3002be91b3b7179bb43ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3750-0398-4106-92b4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:36.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:36Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3750-0398-4106-92b4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3750-0398-4106-92b4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0fd1cbd75db3ca0580105f404138c3ca4b4faace6cf999a706fa1b4dec81a6fb/analysis/1441216994/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3750-1e7c-4018-ad74-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:36.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: dc8b44d90e61ea49085ed4e836ddf5dd857c98cc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '93d476ab2f89455dc4535b78c125ec8c4de0411c970902344586a7d82a758e7f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3751-9214-4dd8-a01e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:37.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: dc8b44d90e61ea49085ed4e836ddf5dd857c98cc",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fb5bd156686e544ebce462f9ae1aa369']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3751-a724-4166-a961-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:37.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:37Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3751-a724-4166-a961-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3751-a724-4166-a961-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/93d476ab2f89455dc4535b78c125ec8c4de0411c970902344586a7d82a758e7f/analysis/1441216993/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3751-afd4-442f-b9ea-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:37.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: d12248136757a0522d5f9b6a5b92453f1e2f8cf4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '99769df1686d1a360358c0325a8ff968d0979a22c2e2b43c7cb5aef19c677a79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3752-aa24-4e4b-8c35-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:38.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: d12248136757a0522d5f9b6a5b92453f1e2f8cf4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aff88e244acb7fa21fbde6c35f2a7dce']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3752-ac08-4f47-b6b6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:38.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:38Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3752-ac08-4f47-b6b6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3752-ac08-4f47-b6b6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/99769df1686d1a360358c0325a8ff968d0979a22c2e2b43c7cb5aef19c677a79/analysis/1430932438/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3752-39fc-4e81-8cca-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:38.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cf2908199eea4692466fb80f1184d59ae1f6ab20",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '83e883040b0754a8925933d65268bcabf02f4b734ef7c96b3c11eb1a4fcc1ca9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3753-8eb4-46fb-9c8b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:39.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cf2908199eea4692466fb80f1184d59ae1f6ab20",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6a0675c8ee96e958be628b1802a6cbfc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3753-3a60-4bf5-8891-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:39.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:39Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3753-3a60-4bf5-8891-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3753-3a60-4bf5-8891-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/83e883040b0754a8925933d65268bcabf02f4b734ef7c96b3c11eb1a4fcc1ca9/analysis/1430932419/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3754-6cb4-4906-bf49-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:40.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cf1cbe1829af40b57aa236db95c08fed2e5b9b9f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a87bbc3a40377d8e7bc351384a70914ad22c86b572f852b665ef04a84b455334']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3754-d928-42b9-8d54-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:40.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cf1cbe1829af40b57aa236db95c08fed2e5b9b9f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '84a7bedd1c9ba34215b66ae5f8758446']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3754-81ac-406c-8d2d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:40.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:40Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3754-81ac-406c-8d2d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3754-81ac-406c-8d2d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a87bbc3a40377d8e7bc351384a70914ad22c86b572f852b665ef04a84b455334/analysis/1430932437/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3755-dc1c-4ebb-b86d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:41.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cddac70af46e911fa463ef55f845efe85f7f0368",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5865c8763922cb7ac50ab0b6d9b343f8734cc9203faf04c79b69a820f29b020a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3755-ddc0-48cb-9a0a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:41.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cddac70af46e911fa463ef55f845efe85f7f0368",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f216164042de870cf304df691609f25a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3755-708c-4e15-807d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:41.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:41Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3755-708c-4e15-807d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3755-708c-4e15-807d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5865c8763922cb7ac50ab0b6d9b343f8734cc9203faf04c79b69a820f29b020a/analysis/1437132388/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3756-b8d4-45fe-87ba-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:42.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cd916216aea8e27cabd77cbc967277d059d56f5f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9e63c7ea0e70bbfa71298f3a5d089e2d182aa2c5461e7c65f1e905f663dbc355']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3756-610c-4c77-8135-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:42.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cd916216aea8e27cabd77cbc967277d059d56f5f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6fa367f8027e58958453742a60bd57bc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3756-2d94-4384-b425-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:42.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:42Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3756-2d94-4384-b425-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3756-2d94-4384-b425-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9e63c7ea0e70bbfa71298f3a5d089e2d182aa2c5461e7c65f1e905f663dbc355/analysis/1442468211/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3757-5e9c-48af-9079-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:43.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cc83526d7dd4fc090b36bd34d47a9849f3e19880",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bb39275007b0cb49582fd22f0e57ed9964c866340308c566edd808a3759d2d73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3757-1f14-4679-af8d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:43.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cc83526d7dd4fc090b36bd34d47a9849f3e19880",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd231b9e57f1224d0e0168cfd46b136d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3758-a7bc-44be-94ea-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:44.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:44Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3758-a7bc-44be-94ea-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3758-a7bc-44be-94ea-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bb39275007b0cb49582fd22f0e57ed9964c866340308c566edd808a3759d2d73/analysis/1441217001/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3758-9e6c-4965-b03e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:44.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cb1e0f4474a95e1e69873a173ff9e8b4cd2350ce",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '066a89ddc255e925398c7faeb795640a9793960ffb81ce79c2b383113355706b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3758-2848-4240-a200-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:44.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: cb1e0f4474a95e1e69873a173ff9e8b4cd2350ce",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7f21fa121902f998983122963512e6c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3759-2a90-4837-8d30-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:45.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:45Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3759-2a90-4837-8d30-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3759-2a90-4837-8d30-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/066a89ddc255e925398c7faeb795640a9793960ffb81ce79c2b383113355706b/analysis/1430932437/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3759-4354-4ec7-adf2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:45.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c9a14c7bf9b62771388277d5616f3be48fa70e4a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '18f1d77371223f6181989ce5ac4014518175140683914a362add5d7b1f1c106c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3759-7ffc-428e-91ef-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:45.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c9a14c7bf9b62771388277d5616f3be48fa70e4a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ae5d56bcedf445f93864b0d692942c3c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375a-15f4-47b1-8f77-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:46.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:46Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375a-15f4-47b1-8f77-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375a-15f4-47b1-8f77-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/18f1d77371223f6181989ce5ac4014518175140683914a362add5d7b1f1c106c/analysis/1437028088/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375a-d8ec-4e12-b4d7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:46.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c90dcfb585193e1caf600d38cf1ac8f6256f5d57",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0eb4d70bde171d2c23b6b736178ac9a410d010e2c156cd4cfb4a2fd2a6d4d437']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375a-99d0-4af0-b92a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:46.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c90dcfb585193e1caf600d38cf1ac8f6256f5d57",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b3d61c07d60ba6a5aaed484e91cc0de']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375b-78c8-4ffc-8b72-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:47.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:47Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375b-78c8-4ffc-8b72-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375b-78c8-4ffc-8b72-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0eb4d70bde171d2c23b6b736178ac9a410d010e2c156cd4cfb4a2fd2a6d4d437/analysis/1440949616/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375b-02d4-457c-9d53-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:47.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c8d869b14c50218ce018ca594ec824afc63fbb77",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd05809a7b38c7f393610b2d94409424d5359ca02c5897865dcf9a1c8b2e0014e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375b-4730-473f-917b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:47.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c8d869b14c50218ce018ca594ec824afc63fbb77",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5aeeff72162defffd1e8a1162add9520']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375c-6230-4d0d-a29d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:48.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:48Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375c-6230-4d0d-a29d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375c-6230-4d0d-a29d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d05809a7b38c7f393610b2d94409424d5359ca02c5897865dcf9a1c8b2e0014e/analysis/1438202295/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375c-90f0-4444-88c1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:48.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c3a7cb43ec13299b758cb8ca25eace71329939f7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'db22227a2626769e7cc51857bf35a425c002fa91ffff07025a56f59348925e29']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375c-7fdc-48b0-bcd8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:48.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: c3a7cb43ec13299b758cb8ca25eace71329939f7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '47c3648100cd0df88f7b57a90ffe8848']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375d-486c-4426-bde9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:49.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:49Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375d-486c-4426-bde9-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375d-486c-4426-bde9-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/db22227a2626769e7cc51857bf35a425c002fa91ffff07025a56f59348925e29/analysis/1436509803/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375d-90d0-4d9d-be60-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:49.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: bd620bef8d9ecf79f4308b4f10f54d7e67ed7d78",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fe7657f1951ba0327517e1f55e1fb78f122374817aa6f8d453a303d2cc832602']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375d-8d18-40c9-98ad-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:49.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: bd620bef8d9ecf79f4308b4f10f54d7e67ed7d78",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd0748cfd8ec66a691d2c6559e666785a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375e-96e8-4d3d-a3cd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:50.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:50Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375e-96e8-4d3d-a3cd-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375e-96e8-4d3d-a3cd-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/fe7657f1951ba0327517e1f55e1fb78f122374817aa6f8d453a303d2cc832602/analysis/1418309974/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375e-c8e8-4bb5-a21c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:50.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: bab55e333ea120f34ae1d8f21f5f1fcbb8a7565f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '57fb54a79f7544b222d44a4b70012717585018cef3310b4da9b5ada42169e552']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375e-3208-4279-b03f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:50.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: bab55e333ea120f34ae1d8f21f5f1fcbb8a7565f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6d1ef8d53b388177436da9ee79f90f74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a375f-d3cc-4ca0-b572-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:51.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:51Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a375f-d3cc-4ca0-b572-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a375f-d3cc-4ca0-b572-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/57fb54a79f7544b222d44a4b70012717585018cef3310b4da9b5ada42169e552/analysis/1435659059/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a375f-49e4-4084-af2a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:51.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ba6e79b17d6a36fc465aa5ff2857f50016e09b9b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dfe046bb578aa7fd45da4b7ea70e8973fab8f918c26326349e6dfcf454aa0183']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3760-7d48-44d8-b3e4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:52.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ba6e79b17d6a36fc465aa5ff2857f50016e09b9b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd129f13590a2525a49a8722ccf82b5e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3760-af50-4bbc-a2e2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:52.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:52Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3760-af50-4bbc-a2e2-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3760-af50-4bbc-a2e2-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/dfe046bb578aa7fd45da4b7ea70e8973fab8f918c26326349e6dfcf454aa0183/analysis/1435159241/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3760-57cc-4bf4-8616-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:52.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: b9e43fc603f1e30b27f23bce88dbe6cdbc16d5b7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bbc4c173f50101a2fbb5903e05c2b30eb1fb9eb5d42a1040ee280806b041b382']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3761-47a4-4352-9ea0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:53.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: b9e43fc603f1e30b27f23bce88dbe6cdbc16d5b7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '945b09223193a50176c291740cbf0eda']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3761-40dc-4d99-9bd7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:53.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:53Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3761-40dc-4d99-9bd7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3761-40dc-4d99-9bd7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bbc4c173f50101a2fbb5903e05c2b30eb1fb9eb5d42a1040ee280806b041b382/analysis/1435816092/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3761-04b8-463d-8c23-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:53.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: b507502ef38d407661b17a788f961ee4ed73a0b4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0affcc51c0a41afe36c132206d8e696fee5a1db2da5373aa7bf959dcce97dab1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3762-d4f4-418d-9481-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:54.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: b507502ef38d407661b17a788f961ee4ed73a0b4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '70f68363dd8bd77c17e3f42d75a0d010']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3762-d418-48c9-9343-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:54.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:54Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3762-d418-48c9-9343-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3762-d418-48c9-9343-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0affcc51c0a41afe36c132206d8e696fee5a1db2da5373aa7bf959dcce97dab1/analysis/1430932435/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3762-3350-4fba-8215-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:54.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ada48cc91ceb53167b64b877f02d6157d18e6c98",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '55b5f98a34ea2a03f8f3cdc7beaeb342014858f1ea0a9c1d09ad5035e5c0ec63']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3763-383c-42e7-a6ce-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:55.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: ada48cc91ceb53167b64b877f02d6157d18e6c98",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6b49155a9a933d3863338aa668ea1cc0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3763-57a4-4cac-86f1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:55.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:55Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3763-57a4-4cac-86f1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3763-57a4-4cac-86f1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/55b5f98a34ea2a03f8f3cdc7beaeb342014858f1ea0a9c1d09ad5035e5c0ec63/analysis/1430378974/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3763-bcb4-4412-859a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:55.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: a53b49df105cdaa1ae686f819473eddc2254e211",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a13afb405ff5fd4e422b42b669ceb0ae86cfd8fd778e4d1381c537cb289737e9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3764-74f0-4ff4-8ec3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:56.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: a53b49df105cdaa1ae686f819473eddc2254e211",
|
||
|
|
"pattern": "[file:hashes.MD5 = '78f7f728220faf7a8f512504d2ffc6ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3764-5814-4dbe-ba0d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:56.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:56Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3764-5814-4dbe-ba0d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3764-5814-4dbe-ba0d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a13afb405ff5fd4e422b42b669ceb0ae86cfd8fd778e4d1381c537cb289737e9/analysis/1443503551/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3764-6924-40d3-8bf6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:56.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9a9f5e2d3778cea8b9a47dea4cbaf7d58b60e6ee",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74fdc10ff52e5e65334511bc9a70c8bc0d4fd73225249a1656256055fa1c9747']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3765-bc20-4516-9970-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:57.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9a9f5e2d3778cea8b9a47dea4cbaf7d58b60e6ee",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bcd84c4231c676418ff5c1740cb951ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3765-4440-4d63-b488-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:57.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:57Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3765-4440-4d63-b488-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3765-4440-4d63-b488-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/74fdc10ff52e5e65334511bc9a70c8bc0d4fd73225249a1656256055fa1c9747/analysis/1443340485/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3765-0af4-4dad-997d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:57.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9a19934f052b1adaeb94ff09b6a7183c8a8b5c9a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fde5a869cebcc8eabba5c0157cc262ef2cca167255676199d00877cbda56a53a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3766-7888-4634-9486-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:58.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9a19934f052b1adaeb94ff09b6a7183c8a8b5c9a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '57c4af66f7fbfe71010261adc674bc95']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3766-395c-4dbe-a568-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:58.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:58Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3766-395c-4dbe-a568-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3766-395c-4dbe-a568-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/fde5a869cebcc8eabba5c0157cc262ef2cca167255676199d00877cbda56a53a/analysis/1443340139/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3767-521c-4395-8eca-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:59.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9908a0ff6b4f25d8ff48a82dae9d22a20a2339ad",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '19faec9364a5eab8a7e5f0111d92ab514e9b74bcf2228c8c719e3588a2272bd4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3767-77b8-4fce-b8d5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:59.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 9908a0ff6b4f25d8ff48a82dae9d22a20a2339ad",
|
||
|
|
"pattern": "[file:hashes.MD5 = '894ab3448048eff91333b478e52ca370']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:01:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3767-ab1c-49d1-85cc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:01:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:01:59.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:01:59Z",
|
||
|
|
"last_observed": "2015-09-29T07:01:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3767-ab1c-49d1-85cc-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3767-ab1c-49d1-85cc-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/19faec9364a5eab8a7e5f0111d92ab514e9b74bcf2228c8c719e3588a2272bd4/analysis/1443339435/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3768-0724-4392-ab3b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:00.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 896fe4edc6ca4a29da0eaf11a2aac1e3a367dced",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a9a426878fc2dd314544af3753b760ebb6551af9b39b568f56a769ab1105de39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3768-02b4-49c9-9446-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:00.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 896fe4edc6ca4a29da0eaf11a2aac1e3a367dced",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cb0f1b4eef8b10105594e73361415464']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3768-394c-4239-bd89-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:00.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:00Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3768-394c-4239-bd89-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3768-394c-4239-bd89-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a9a426878fc2dd314544af3753b760ebb6551af9b39b568f56a769ab1105de39/analysis/1443332421/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3769-e490-4975-89cc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:01.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 7bf7ee5762f06310506d32995f273fc74f4c6af5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd1dfe5c2b963cfbcb15dc9a11c4adefc3a336a04844cded28244f2528392dfbd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3769-ce14-43e9-9a85-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:01.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 7bf7ee5762f06310506d32995f273fc74f4c6af5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9b6d2ffebb1b7d530dedae1f5d45fd2d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3769-e1b0-4208-8eb8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:01.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:01Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3769-e1b0-4208-8eb8-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3769-e1b0-4208-8eb8-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d1dfe5c2b963cfbcb15dc9a11c4adefc3a336a04844cded28244f2528392dfbd/analysis/1443100345/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376a-f9e4-4788-a864-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:02.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 6d8b71c453b0712fa5d0e02fc1ba6093d8b9237c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a8948d852d84d059195d32e03cab5aad0fd1228fb7fe5541bd78ab126b59c6c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376a-f060-4d80-8f38-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:02.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 6d8b71c453b0712fa5d0e02fc1ba6093d8b9237c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8a61caf26fde9b1a7548546d690826ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a376a-9378-4817-914b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:02.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:02Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a376a-9378-4817-914b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a376a-9378-4817-914b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a8948d852d84d059195d32e03cab5aad0fd1228fb7fe5541bd78ab126b59c6c6/analysis/1443092629/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376b-dcd8-4bd8-bf7f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:03.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 6c8cd7f5e7ffb65432f07e9e1c5d6d244984021b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '47e423367ec03d760d5f4776da3572fda91b7879e97b6d370b2702d652e62085']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376b-ed44-4056-bdcd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:03.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 6c8cd7f5e7ffb65432f07e9e1c5d6d244984021b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '88ae55c635b627aed3c86d56a560e9b8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a376b-f054-4c79-aee8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:03.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:03Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a376b-f054-4c79-aee8-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a376b-f054-4c79-aee8-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/47e423367ec03d760d5f4776da3572fda91b7879e97b6d370b2702d652e62085/analysis/1439630665/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376c-4ce4-4e52-890c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:04.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 626b550c9c53c515d63de0aa3f84dfdb4aa546ad",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6f47e5ac3f3bf7780d2d5a4c0bef562dc0848d517f0728fff1df35759dbd6b48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376c-bb1c-4b31-9d22-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:04.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 626b550c9c53c515d63de0aa3f84dfdb4aa546ad",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7bb55bf7fbd62d18ccfec0ad534fb37c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a376c-d5a4-4833-b208-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:04.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:04Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a376c-d5a4-4833-b208-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a376c-d5a4-4833-b208-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6f47e5ac3f3bf7780d2d5a4c0bef562dc0848d517f0728fff1df35759dbd6b48/analysis/1443080833/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376d-0bf4-4bd5-b775-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:05.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 61e72119d993cab21cba481e1ffb6f9f46fa55f0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '600f1866c605bace125894f0d3acc38ecc0f00fcf1442c93fbe8a1cfe5723344']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376d-19bc-4bd3-900a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:05.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 61e72119d993cab21cba481e1ffb6f9f46fa55f0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4ca39c6e82a1274c5a433eaff5ed8a99']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a376e-6f48-4b1c-9d5a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:06.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:06Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a376e-6f48-4b1c-9d5a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a376e-6f48-4b1c-9d5a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/600f1866c605bace125894f0d3acc38ecc0f00fcf1442c93fbe8a1cfe5723344/analysis/1441602338/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376e-9cb4-4428-a113-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:06.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 5be3f8bd1de43f3325865a887d654e97097353ba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a335bdcf7cb7ce71d0ec73dc1ff90385094db6db7235fb335b2753f559a22936']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376e-da60-495d-ae70-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:06.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 5be3f8bd1de43f3325865a887d654e97097353ba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4877c48074c872b07c1ad98c948db520']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a376f-7928-4b4b-b04a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:07.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:07Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a376f-7928-4b4b-b04a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a376f-7928-4b4b-b04a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a335bdcf7cb7ce71d0ec73dc1ff90385094db6db7235fb335b2753f559a22936/analysis/1415327139/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376f-5108-4c22-b0c9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:07.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 5b513e490334e82b066c4392626efed35a641b93",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'de8a3cfa010e585d1c73e80493d96f04740d90756c197f31f5ba5b36f73eedd1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a376f-2890-40de-8035-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:07.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 5b513e490334e82b066c4392626efed35a641b93",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4eeedee26b4b9d15809f8cdfb9788bee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3770-a60c-4002-9713-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:08.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:08Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3770-a60c-4002-9713-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3770-a60c-4002-9713-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/de8a3cfa010e585d1c73e80493d96f04740d90756c197f31f5ba5b36f73eedd1/analysis/1426748402/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3770-d400-4c6f-b320-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:08.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 59f0119085ada628e01e57b04bc17d6a8def167f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bdceba310703becbb8f0ad4b4cda614c035119939348d5aae16b350ba78e5796']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3770-2b60-4818-99ab-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:08.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 59f0119085ada628e01e57b04bc17d6a8def167f",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'accbfdf7faafa2f8b0a9c17bc040dda6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3771-53a4-49b5-b5d0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:09.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:09Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3771-53a4-49b5-b5d0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3771-53a4-49b5-b5d0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bdceba310703becbb8f0ad4b4cda614c035119939348d5aae16b350ba78e5796/analysis/1434625332/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3771-5118-4012-810e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:09.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 58560676784e5d122293661f7c81eeb12dd1e641",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '49609beedcec3274beab10e62d9ef206562aad40adf92af0178da9afe822f972']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3771-7f00-46d8-bd7a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:09.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 58560676784e5d122293661f7c81eeb12dd1e641",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6c7ac8dfd7bc5c2bb1a6d7aec488c298']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3772-14c4-4d36-8b9c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:10.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:10Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3772-14c4-4d36-8b9c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3772-14c4-4d36-8b9c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/49609beedcec3274beab10e62d9ef206562aad40adf92af0178da9afe822f972/analysis/1442486947/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3772-3b64-409f-9bbc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:10.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 4ad5e80794532928d5faa72af68a33fa3d1ab587",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '64ba4cf90cfc09dacdfcd75fff80aa5b77e6fb5bbf0b2069dd305f1e83e1403e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3772-66b4-4247-b821-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:10.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 4ad5e80794532928d5faa72af68a33fa3d1ab587",
|
||
|
|
"pattern": "[file:hashes.MD5 = '01be04b5e66966abeef8da0420f40d3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3773-3770-4397-b59e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:11.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:11Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3773-3770-4397-b59e-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3773-3770-4397-b59e-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/64ba4cf90cfc09dacdfcd75fff80aa5b77e6fb5bbf0b2069dd305f1e83e1403e/analysis/1436253074/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3773-6fcc-4416-8bc7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:11.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 489f70efbcbcaa6534185de0abd02dd5f128d11d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95646570c7df7f8d29811c3221b88f0a09565ecc66c2ce3cb50fda269700f93f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3774-33f0-4ef8-9606-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:12.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 489f70efbcbcaa6534185de0abd02dd5f128d11d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '63352bb0dd71d7da4d64702433ce3922']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3774-f1d4-46ee-bc93-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:12.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:12Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3774-f1d4-46ee-bc93-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3774-f1d4-46ee-bc93-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/95646570c7df7f8d29811c3221b88f0a09565ecc66c2ce3cb50fda269700f93f/analysis/1426747998/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3774-57b0-4c5f-9787-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:12.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 40d4dfdba734483dbf3119a9cd3531086e6aba00",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e6200229d710b628b9f9883609ccae1b097f9dc9e98f8ba8f78ccff2f6aee60c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3775-8f70-48eb-9904-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:13.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 40d4dfdba734483dbf3119a9cd3531086e6aba00",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9682de0af4122b4cf12782d67aae7e24']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3775-9a48-4c2d-9df6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:13.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:13Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3775-9a48-4c2d-9df6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3775-9a48-4c2d-9df6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e6200229d710b628b9f9883609ccae1b097f9dc9e98f8ba8f78ccff2f6aee60c/analysis/1441705429/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3775-259c-4d02-9ea7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:13.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 400631fecfc435a47578d482471bc4817ae4dc81",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bc96522ddb223c86ee4366b2a57e1b37edeefcd7a98c8cb1e65136ae3b8fdc48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3776-522c-41b7-9782-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:14.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 400631fecfc435a47578d482471bc4817ae4dc81",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5daafbf8e38fddb7b2d98b1b402695cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3776-4f18-4c5e-ab65-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:14.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:14Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3776-4f18-4c5e-ab65-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3776-4f18-4c5e-ab65-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bc96522ddb223c86ee4366b2a57e1b37edeefcd7a98c8cb1e65136ae3b8fdc48/analysis/1441704970/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3776-2020-4374-aed1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:14.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 236601366984731026238957f79b47540be87d31",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c12417d40bd49c8b9961116501d6a4e4e554abe9e4c7b95b25f04def88f09798']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3777-296c-4f08-92f2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:15.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 236601366984731026238957f79b47540be87d31",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1bb6d560c70e3f455b86aada396bafa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3777-bde0-4cf4-87ef-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:15.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:15Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3777-bde0-4cf4-87ef-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3777-bde0-4cf4-87ef-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c12417d40bd49c8b9961116501d6a4e4e554abe9e4c7b95b25f04def88f09798/analysis/1434934614/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3777-b3bc-48c6-a8b6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:15.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 19cc1c2c632e885456d574e91bc6fefb78969337",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '605bd0ffee36eb797a644707ee05bd0f5fc39e81e525cc5c44e2f905cf53055b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3778-a0a4-4d33-97d9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:16.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 19cc1c2c632e885456d574e91bc6fefb78969337",
|
||
|
|
"pattern": "[file:hashes.MD5 = '34868fb114e64d6d3aec1c1f817f045a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3778-57c0-4d02-9019-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:16.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:16Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3778-57c0-4d02-9019-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3778-57c0-4d02-9019-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/605bd0ffee36eb797a644707ee05bd0f5fc39e81e525cc5c44e2f905cf53055b/analysis/1434620076/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3778-0e78-4be2-acbc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:16.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 1716a5e070d4dd894f9fe3c275f9eb0cf2f7366e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'db6174cee9e586a21ff5753922cd8dddd1ed22605d702856c0449ef0c8ee14cc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3779-0dbc-4948-84dd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:17.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 1716a5e070d4dd894f9fe3c275f9eb0cf2f7366e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3fd73e1dd089e1dd411064eb18097483']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3779-25c4-4ca0-9d8b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:17.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:17Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3779-25c4-4ca0-9d8b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3779-25c4-4ca0-9d8b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/db6174cee9e586a21ff5753922cd8dddd1ed22605d702856c0449ef0c8ee14cc/analysis/1425716626/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3779-ec0c-4083-9279-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:17.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 0d3cd2a3f96ef987d1c573a93e22aac2960f3e8f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c6f62b4f46a8f152fe0a64a369823cee0831ba57e5590eb923073e4daba4ca9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377a-0fd8-48b7-ac54-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:18.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 0d3cd2a3f96ef987d1c573a93e22aac2960f3e8f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0172b15338f5899ee6d5c821898357b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377a-c744-4a03-8ebb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:18.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:18Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377a-c744-4a03-8ebb-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377a-c744-4a03-8ebb-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c6f62b4f46a8f152fe0a64a369823cee0831ba57e5590eb923073e4daba4ca9c/analysis/1435212177/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377a-5734-4231-9849-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:18.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 0836e191a3acc68691678da93b27a4647ed0b81a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c7d82d740fd989ab935606f7faac3f306e15f9c96f319d6787652a9a728ce5e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377b-9ea8-48e9-94e3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:19.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 0836e191a3acc68691678da93b27a4647ed0b81a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '32f40ddedb171ae06d296e486357e4d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377b-1924-4b9c-9a50-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:19.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:19Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377b-1924-4b9c-9a50-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377b-1924-4b9c-9a50-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c7d82d740fd989ab935606f7faac3f306e15f9c96f319d6787652a9a728ce5e1/analysis/1430932421/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377c-8428-49c0-8930-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:20.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 06e15e42d9afbc5fa60f550a4e05d8465ac97962",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f5fd5a4954e02301ae810fd9d8c885da9ce7afd13091dbf7a35bce58c4d7ed3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377c-6ac4-47ae-ad3e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:20.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 06e15e42d9afbc5fa60f550a4e05d8465ac97962",
|
||
|
|
"pattern": "[file:hashes.MD5 = '425e6e29a9a22a3c4fe523be0d50682e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377c-a250-4497-bbd1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:20.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:20Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377c-a250-4497-bbd1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377c-a250-4497-bbd1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3f5fd5a4954e02301ae810fd9d8c885da9ce7afd13091dbf7a35bce58c4d7ed3/analysis/1414229486/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377d-9e1c-4254-8878-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:21.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 03062e13fa18d1fbf3ceb9af8066d44be14b1a98",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a5ae813310eac44dc7dbce47be41260f8de90c6331d4cbd31d75c2847f8e3308']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377d-a164-44b7-b8aa-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:21.000Z",
|
||
|
|
"description": "Zbot - Xchecked via VT: 03062e13fa18d1fbf3ceb9af8066d44be14b1a98",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2d0ec9c8524420e00fe24e13ded5403d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377d-9b90-4546-b935-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:21.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:21Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377d-9b90-4546-b935-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377d-9b90-4546-b935-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a5ae813310eac44dc7dbce47be41260f8de90c6331d4cbd31d75c2847f8e3308/analysis/1441277110/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377e-70a4-4dac-bf28-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:22.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: e7fde2d37367618397ae1f064f2837b22a74a2bc",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '450a0e657446a39de943e062ac5dbfa840265842f6ccb8cec7ad59853b14a307']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377e-90e0-48de-90ec-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:22.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: e7fde2d37367618397ae1f064f2837b22a74a2bc",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7dffdcc0255926e54e535f1d04e9a1f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377e-f108-4071-83c4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:22.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:22Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377e-f108-4071-83c4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377e-f108-4071-83c4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/450a0e657446a39de943e062ac5dbfa840265842f6ccb8cec7ad59853b14a307/analysis/1442847880/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377f-0d8c-4e19-8000-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:23.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 4edb139f6d459f3a7dd31abba29a4c6c3046072f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '63e20442190242deea15dac06966610d6fa84070d9382bfa5e84571262bea69b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a377f-f780-4824-9b84-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:23.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 4edb139f6d459f3a7dd31abba29a4c6c3046072f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2f8c5bd8d41c0cc2b620acf69bfa38ac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a377f-de8c-476c-92ec-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:23.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:23Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a377f-de8c-476c-92ec-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a377f-de8c-476c-92ec-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/63e20442190242deea15dac06966610d6fa84070d9382bfa5e84571262bea69b/analysis/1442272285/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3780-2dc0-451f-a66a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:24.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 2de039f70be6062201bb1d890a510730009c429a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a5a96f3c9671af589f56c46b7fba7a3d3bd2a8e86383c761526a71cb4263349']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3780-d450-4264-b43d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:24.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 2de039f70be6062201bb1d890a510730009c429a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2ac3a107f29eb9529a9cb3e68adc58b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3780-8dcc-4d20-99a0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:24.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:24Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3780-8dcc-4d20-99a0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3780-8dcc-4d20-99a0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3a5a96f3c9671af589f56c46b7fba7a3d3bd2a8e86383c761526a71cb4263349/analysis/1442590108/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3781-e63c-4030-88a8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:25.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 1195c4627be54f26b29d0dc56752d233547ff6a4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9df2b123a9e76358c7caf6b24b2f809ceb1a61e149c60d08d33a87952061cc9b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3781-c944-48eb-8125-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:25.000Z",
|
||
|
|
"description": "Wauchos - Xchecked via VT: 1195c4627be54f26b29d0dc56752d233547ff6a4",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0603138bf9962f507a76d849b1ffd220']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3781-e0b0-4176-9f7a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:25.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:25Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3781-e0b0-4176-9f7a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3781-e0b0-4176-9f7a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9df2b123a9e76358c7caf6b24b2f809ceb1a61e149c60d08d33a87952061cc9b/analysis/1433510858/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3782-1648-411d-a167-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:26.000Z",
|
||
|
|
"description": "VBSFlood - Xchecked via VT: cf164075d6a7270c518bb9a860c75c7e688d5e8b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7e045099e37cbb5458c9d2bfef2790ad0a6b6a129c6ec6051c58161a762d2880']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3782-c4ec-4ce1-ba9a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:26.000Z",
|
||
|
|
"description": "VBSFlood - Xchecked via VT: cf164075d6a7270c518bb9a860c75c7e688d5e8b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cfaaa8758d8b39b88037aac767f0dad8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3783-3f68-4f89-bcff-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:27.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:27Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3783-3f68-4f89-bcff-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3783-3f68-4f89-bcff-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7e045099e37cbb5458c9d2bfef2790ad0a6b6a129c6ec6051c58161a762d2880/analysis/1430932436/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3783-ea68-4937-a5f0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:27.000Z",
|
||
|
|
"description": "VB - Xchecked via VT: 92f18ea77d533735f1f0c54e81aa6bbf3746c96b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '06e992f9dccff841d0bee712bbbfa3c8bd09b4a71f6d3521c3b647fdcd9562ea']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3783-ae8c-4f81-bbcb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:27.000Z",
|
||
|
|
"description": "VB - Xchecked via VT: 92f18ea77d533735f1f0c54e81aa6bbf3746c96b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1556b9152b9f0bb83835ac61b692d54a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3784-922c-42ef-af28-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:28.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:28Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3784-922c-42ef-af28-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3784-922c-42ef-af28-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/06e992f9dccff841d0bee712bbbfa3c8bd09b4a71f6d3521c3b647fdcd9562ea/analysis/1443335661/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3784-cfe0-4990-9315-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:28.000Z",
|
||
|
|
"description": "VB - Xchecked via VT: 0b382fb11442c893eeafd2774f3716f5163d4400",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c739ff9b1332a85b176e8c9c8b08be3fc328814744ad24e3521725aa86b20e78']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3784-0a88-4838-b2c6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:28.000Z",
|
||
|
|
"description": "VB - Xchecked via VT: 0b382fb11442c893eeafd2774f3716f5163d4400",
|
||
|
|
"pattern": "[file:hashes.MD5 = '32f71cce057b4d95553d866e394323af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3785-d818-4253-8d5b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:29.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:29Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3785-d818-4253-8d5b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3785-d818-4253-8d5b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c739ff9b1332a85b176e8c9c8b08be3fc328814744ad24e3521725aa86b20e78/analysis/1434620022/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3785-ea64-41c9-89d9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:29.000Z",
|
||
|
|
"description": "Vawtrak - Xchecked via VT: 53ebd50f65b0c41d199451ef7b667cd5628c0947",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '96eb0105ea46a6383d8d6c6d036c213ac2082d0350d4089c70c3168204e10b94']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3785-8178-4e0b-9646-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:29.000Z",
|
||
|
|
"description": "Vawtrak - Xchecked via VT: 53ebd50f65b0c41d199451ef7b667cd5628c0947",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a5464060f3e1db29f2a94180477607c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3786-3f58-4e0c-a925-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:30.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:30Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3786-3f58-4e0c-a925-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3786-3f58-4e0c-a925-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/96eb0105ea46a6383d8d6c6d036c213ac2082d0350d4089c70c3168204e10b94/analysis/1430932425/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3786-cb88-4f47-81ff-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:30.000Z",
|
||
|
|
"description": "Vawtrak - Xchecked via VT: 4ec7f0703c33be891027492571b1bf2585da3d30",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '572b59ec1b8cd3335475e92476b93e229fc8eab667796b7bc31dd5eb2058bc7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3786-aa30-4775-8915-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:30.000Z",
|
||
|
|
"description": "Vawtrak - Xchecked via VT: 4ec7f0703c33be891027492571b1bf2585da3d30",
|
||
|
|
"pattern": "[file:hashes.MD5 = '25adf365f5705564160c281943e8e338']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3787-f4a4-48cb-8568-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:31.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:31Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3787-f4a4-48cb-8568-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3787-f4a4-48cb-8568-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/572b59ec1b8cd3335475e92476b93e229fc8eab667796b7bc31dd5eb2058bc7b/analysis/1431587084/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3787-d6dc-41fc-beb7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:31.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: acacf20479c47c76550c82f8ff583ee75a092c6c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '15dde371624da49cad002d4a4deff5c4abc9001557ac2ab2934114bc68bbe0c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3787-c67c-4d05-a729-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:31.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: acacf20479c47c76550c82f8ff583ee75a092c6c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '48e5f0ec037630bf4c9014db6b17a205']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3788-eee4-4968-93cd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:32.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:32Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3788-eee4-4968-93cd-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3788-eee4-4968-93cd-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/15dde371624da49cad002d4a4deff5c4abc9001557ac2ab2934114bc68bbe0c6/analysis/1404733602/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3788-62d8-4701-8ac3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:32.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 5673a1e6b04cd77ee613903191c21f6db5c38dc6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0c85f37e36b5cdfa5182f2e3ddfec29e70545ffeebda6efd3728b302504cc93b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3789-448c-4063-9ac3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:33.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 5673a1e6b04cd77ee613903191c21f6db5c38dc6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4ad92dd898389f8f26d849094db0eb2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3789-8c9c-4c85-87d1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:33.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:33Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3789-8c9c-4c85-87d1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3789-8c9c-4c85-87d1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0c85f37e36b5cdfa5182f2e3ddfec29e70545ffeebda6efd3728b302504cc93b/analysis/1434621052/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3789-05ac-4b5a-80f0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:33.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 563f20c755dfd43840de7c060cf653395c9f3c61",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '21357ec4518dda676b329e7698968ab27035c2ccd6fdbec866693a19000bd999']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378a-b39c-4734-b52d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:34.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 563f20c755dfd43840de7c060cf653395c9f3c61",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c39b4879a6fd23da0b3ecead1fe3871']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378a-db6c-4bab-ba6b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:34.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:34Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378a-db6c-4bab-ba6b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378a-db6c-4bab-ba6b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/21357ec4518dda676b329e7698968ab27035c2ccd6fdbec866693a19000bd999/analysis/1430932408/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378a-1928-48db-9a2f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:34.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 5517896a2e9dff5db6394b9af2542c191bf1f07c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bb7c6906327cbbd64b807ffbd7a7bf9251ea1175ec0f043b9278122a31f64157']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378b-bfec-4ec3-a3c4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:35.000Z",
|
||
|
|
"description": "Trontoz - Xchecked via VT: 5517896a2e9dff5db6394b9af2542c191bf1f07c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '01a52343783824ac5140463d86a3fb14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378b-6964-4ad4-85f3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:35.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:35Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378b-6964-4ad4-85f3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378b-6964-4ad4-85f3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bb7c6906327cbbd64b807ffbd7a7bf9251ea1175ec0f043b9278122a31f64157/analysis/1430932426/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378b-547c-4cc0-b29c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:35.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: ac68ad2e5f5802a6ab9e7e1c1ec7fab3c6bdbaa4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '75f66f30e4ac5c76683d3d8328cae22a6f2bbbfcf27d8fc8c92c3db5de47bfda']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378c-e4ec-423b-8920-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:36.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: ac68ad2e5f5802a6ab9e7e1c1ec7fab3c6bdbaa4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'deac737af0cbbd8cc4da61e43433424c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378c-8370-4d98-b86c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:36.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:36Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378c-8370-4d98-b86c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378c-8370-4d98-b86c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/75f66f30e4ac5c76683d3d8328cae22a6f2bbbfcf27d8fc8c92c3db5de47bfda/analysis/1442471949/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378c-475c-4c96-84e5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:36.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: 81e43d653acd2b55c8d3107e5b50007870d84d76",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '15dd0af75baa3f9d249bb2f257927913dfeb6f65392f8359d09cf8781590462f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378d-8e5c-4da4-9872-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:37.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: 81e43d653acd2b55c8d3107e5b50007870d84d76",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8ed397f1771dd0fa5b20f604d2b3db9f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378d-6450-41cf-a9df-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:37.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:37Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378d-6450-41cf-a9df-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378d-6450-41cf-a9df-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/15dd0af75baa3f9d249bb2f257927913dfeb6f65392f8359d09cf8781590462f/analysis/1443330450/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378d-3de4-4ac1-95f9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:37.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: 7162bb61cd36ed8b7ee98cbd0bffec33d34dd3e7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bd73e4e756525e78d80a52f23baceef1ffbbbe22679e949887aa8746344cd46a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378e-0b40-49fc-a63f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:38.000Z",
|
||
|
|
"description": "Toshliph - Xchecked via VT: 7162bb61cd36ed8b7ee98cbd0bffec33d34dd3e7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '012a11e4cf754d54601fd6001e4c5748']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378e-b608-41bd-b7f3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:38.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:38Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378e-b608-41bd-b7f3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378e-b608-41bd-b7f3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bd73e4e756525e78d80a52f23baceef1ffbbbe22679e949887aa8746344cd46a/analysis/1443095134/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378e-e380-48fe-bd0f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:38.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: c7d5061a697f9932af2b61f6eb01f2a80398b161",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '766b9a0b01a69adeff1fd58e52f107842e47d6d7abbb2eb2048173ad12c0145d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a378f-2510-4f9e-a679-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:39.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: c7d5061a697f9932af2b61f6eb01f2a80398b161",
|
||
|
|
"pattern": "[file:hashes.MD5 = '147b8d36414e4e49f085e570df20fd31']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a378f-b8b0-44a2-8b72-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:39.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:39Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a378f-b8b0-44a2-8b72-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a378f-b8b0-44a2-8b72-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/766b9a0b01a69adeff1fd58e52f107842e47d6d7abbb2eb2048173ad12c0145d/analysis/1441216999/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3790-1e48-4799-91be-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:40.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: a4adf95a2f0cf230a388fb653d371e4ab3e0388f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b390d3ae96c14eafab24954e5f57973637b5caf95795a808c39358ccded3b255']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3790-d8e4-403b-b061-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:40.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: a4adf95a2f0cf230a388fb653d371e4ab3e0388f",
|
||
|
|
"pattern": "[file:hashes.MD5 = '690b3aa7810c254620003906718b5fb2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3790-327c-4570-a263-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:40.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:40Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3790-327c-4570-a263-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3790-327c-4570-a263-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b390d3ae96c14eafab24954e5f57973637b5caf95795a808c39358ccded3b255/analysis/1443503291/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3791-bc00-4cca-aeb1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:41.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: 68ceae9ccb80f79aba58a1964b2946ee543fb541",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cdea2f89fadb6665e40e97734671e085113afe8b18dc80d4fd5da7596673a1b5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3791-f4c8-4536-98ba-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:41.000Z",
|
||
|
|
"description": "Tinba - Xchecked via VT: 68ceae9ccb80f79aba58a1964b2946ee543fb541",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b4b621e4112389657059fb9f584b4adb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3791-4ac8-4fac-8d2f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:41.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:41Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3791-4ac8-4fac-8d2f-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3791-4ac8-4fac-8d2f-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/cdea2f89fadb6665e40e97734671e085113afe8b18dc80d4fd5da7596673a1b5/analysis/1443083909/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3792-d9d8-4784-af5d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:42.000Z",
|
||
|
|
"description": "Throwback - Xchecked via VT: 6d1d0dde5aa796e0be18577bfdbb81bd6c9b2dcb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6eadf3ecf0cd5123d236617c64151958edab3b7a086cae0f10ebd819a67c08ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3792-919c-42e0-b28a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:42.000Z",
|
||
|
|
"description": "Throwback - Xchecked via VT: 6d1d0dde5aa796e0be18577bfdbb81bd6c9b2dcb",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5c6eaa9fe6dc9af9cfc1126cbc3a0b2c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3792-7c7c-4019-a062-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:42.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:42Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3792-7c7c-4019-a062-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3792-7c7c-4019-a062-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6eadf3ecf0cd5123d236617c64151958edab3b7a086cae0f10ebd819a67c08ab/analysis/1443091133/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3793-ddd8-4b26-93de-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:43.000Z",
|
||
|
|
"description": "Throwback - Xchecked via VT: 1571d05e37f7bf6c7f2d5930c3c17c6cbb1ef78e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '70b893d7bbea28c993d7a47697702cd90d26d6f4ec35b766a99234bb295954ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3793-e118-49ed-928d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:43.000Z",
|
||
|
|
"description": "Throwback - Xchecked via VT: 1571d05e37f7bf6c7f2d5930c3c17c6cbb1ef78e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bd16d3a36a5d314327e11b56938015aa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3793-8468-4b19-83a6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:43.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:43Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3793-8468-4b19-83a6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3793-8468-4b19-83a6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/70b893d7bbea28c993d7a47697702cd90d26d6f4ec35b766a99234bb295954ae/analysis/1436422991/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3794-9f90-4e7a-8b06-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:44.000Z",
|
||
|
|
"description": "Staser - Xchecked via VT: 2a4d4c699fb34a31ab2b5f8a67735ec3093aa2c4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7255aa3c4ae8ff45604d9891886315d72ae9e2ff9c6f2c96ed17523f8c7e083b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3794-e56c-4aa3-9994-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:44.000Z",
|
||
|
|
"description": "Staser - Xchecked via VT: 2a4d4c699fb34a31ab2b5f8a67735ec3093aa2c4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1eb748f91cb0332fbf2df70fa76462a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3794-b024-4e64-b4c3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:44.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:44Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3794-b024-4e64-b4c3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3794-b024-4e64-b4c3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7255aa3c4ae8ff45604d9891886315d72ae9e2ff9c6f2c96ed17523f8c7e083b/analysis/1430932424/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3795-4a84-4c04-8a73-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:45.000Z",
|
||
|
|
"description": "SpyGate - Xchecked via VT: 785d0c848124c23895fc62e45c9e61eabb3170c3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2ae1b95fd845c49d87e48ac1ec6488deeb46469535be32540fcd388dec16a560']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3795-ca04-403f-a512-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:45.000Z",
|
||
|
|
"description": "SpyGate - Xchecked via VT: 785d0c848124c23895fc62e45c9e61eabb3170c3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '71771b341786f70d7cb3978e9bfc9ea7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3795-bbf8-4610-b9a5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:45.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:45Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3795-bbf8-4610-b9a5-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3795-bbf8-4610-b9a5-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2ae1b95fd845c49d87e48ac1ec6488deeb46469535be32540fcd388dec16a560/analysis/1443098032/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3796-3fa0-4aa6-a007-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:46.000Z",
|
||
|
|
"description": "SpyGate - Xchecked via VT: 0ed093948ab56f7b7f35efd4418523fb265d50e7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7a417ccaab01beda550d4465e5c5f5f6468cdc252c8347163ab076ee3b56d64d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3796-62c8-4a9e-bffd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:46.000Z",
|
||
|
|
"description": "SpyGate - Xchecked via VT: 0ed093948ab56f7b7f35efd4418523fb265d50e7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9a625fa252fc6709e76f818e67f0ac88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3797-7124-4ce3-a34d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:47.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:47Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3797-7124-4ce3-a34d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3797-7124-4ce3-a34d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7a417ccaab01beda550d4465e5c5f5f6468cdc252c8347163ab076ee3b56d64d/analysis/1437033170/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3797-ebe0-45cd-b359-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:47.000Z",
|
||
|
|
"description": "Sopinar - Xchecked via VT: b6a482779df4e6ef7e5bcec4675f396002ad7662",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ca6b5bc50cd06a70f10b1000dccb3300c8e078c66035adccd04e2cc933e06bae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3797-8794-49c3-8c02-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:47.000Z",
|
||
|
|
"description": "Sopinar - Xchecked via VT: b6a482779df4e6ef7e5bcec4675f396002ad7662",
|
||
|
|
"pattern": "[file:hashes.MD5 = '43bb48d263afd8a6da973f0c11395f11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3798-2b38-4bfb-b82d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:48.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:48Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3798-2b38-4bfb-b82d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3798-2b38-4bfb-b82d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ca6b5bc50cd06a70f10b1000dccb3300c8e078c66035adccd04e2cc933e06bae/analysis/1434003937/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3798-0830-4498-9249-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:48.000Z",
|
||
|
|
"description": "Sheldor - Xchecked via VT: f8faa7149d2a35206ab3bace2673447014ac2b1a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '648c7985f833ad4e001ab3d1727a1837df640fd3457c808e0ff0d2e4cf61bfa7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3798-1a98-4604-a3c5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:48.000Z",
|
||
|
|
"description": "Sheldor - Xchecked via VT: f8faa7149d2a35206ab3bace2673447014ac2b1a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dc703923026350d552d547ee03146d57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3799-bcbc-484e-a391-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:49.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:49Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3799-bcbc-484e-a391-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3799-bcbc-484e-a391-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/648c7985f833ad4e001ab3d1727a1837df640fd3457c808e0ff0d2e4cf61bfa7/analysis/1431406222/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3799-07dc-429c-9a16-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:49.000Z",
|
||
|
|
"description": "Sheldor - Xchecked via VT: 94efad86fc7439b8fdfe4cd2fc8d0b3433f67809",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd61abd2f4fdb5a4c9e2cb11a2af69ec18627335f7e0e3ddf880d30590292fa6d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3799-3f80-47b4-8709-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:49.000Z",
|
||
|
|
"description": "Sheldor - Xchecked via VT: 94efad86fc7439b8fdfe4cd2fc8d0b3433f67809",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f08f126df999f74c52252aeddad5a9e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379a-5cf4-4abe-8b62-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:50.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:50Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379a-5cf4-4abe-8b62-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379a-5cf4-4abe-8b62-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d61abd2f4fdb5a4c9e2cb11a2af69ec18627335f7e0e3ddf880d30590292fa6d/analysis/1443337581/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379a-9608-454f-ad8b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:50.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: ec4615aaaff5d786ea7e9640ead158f0a84f2674",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '21e0d8b807684b872a5e01ed9e3ddedb7db852bd28287adce612a01dc2fd6e25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379a-7ac4-4a24-8953-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:50.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: ec4615aaaff5d786ea7e9640ead158f0a84f2674",
|
||
|
|
"pattern": "[file:hashes.MD5 = '452ab8baae4a6101b0fc5c85a1e7d676']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379b-f718-4cd9-a73b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:51.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:51Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379b-f718-4cd9-a73b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379b-f718-4cd9-a73b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/21e0d8b807684b872a5e01ed9e3ddedb7db852bd28287adce612a01dc2fd6e25/analysis/1441347163/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379b-aa38-4275-9e4b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:51.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: eb5735cc503260fa583004b6643f704d441d05ec",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f64c1c939260e64a84b6a125d5b6b7c1a8c8a45fbc74bfe1142047c1972854f2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379b-aa44-4014-bb62-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:51.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: eb5735cc503260fa583004b6643f704d441d05ec",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8a69b962a728effd007a5fb9c11adbc3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379c-d52c-4a76-8ee9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:52.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:52Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379c-d52c-4a76-8ee9-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379c-d52c-4a76-8ee9-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f64c1c939260e64a84b6a125d5b6b7c1a8c8a45fbc74bfe1142047c1972854f2/analysis/1441347669/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379c-423c-4791-bfc7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:52.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: 13523cfce0c813a571534ae1f447d8887efa40ae",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '40b9a9cd294912a0f2b94743c673aa5c97fbb2350918012b8aaeb2c25b2fcf8c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379c-c704-40b0-b2c3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:52.000Z",
|
||
|
|
"description": "Sekur - Xchecked via VT: 13523cfce0c813a571534ae1f447d8887efa40ae",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd76c16144362e2b13bdfbe39e11c90eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379d-b79c-4554-962d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:53.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:53Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379d-b79c-4554-962d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379d-b79c-4554-962d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/40b9a9cd294912a0f2b94743c673aa5c97fbb2350918012b8aaeb2c25b2fcf8c/analysis/1408963735/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379d-5208-42b0-8f42-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:53.000Z",
|
||
|
|
"description": "Rovnix - Xchecked via VT: cf4d668c6e0f7912c13ce2b73add4972bc3d6f4e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4c93e35389b259352e1b8fe0c90a4d8e6770b5b2bb8a53e571ee505d681b3a8c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379e-a104-42f8-b6a7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:53.000Z",
|
||
|
|
"description": "Rovnix - Xchecked via VT: cf4d668c6e0f7912c13ce2b73add4972bc3d6f4e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ae07906dfc77cc38c1bda3c82859ab48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379e-e380-49c4-aa6c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:54.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:54Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379e-e380-49c4-aa6c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379e-e380-49c4-aa6c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/4c93e35389b259352e1b8fe0c90a4d8e6770b5b2bb8a53e571ee505d681b3a8c/analysis/1432205111/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379e-6d54-466e-bbef-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:54.000Z",
|
||
|
|
"description": "Repezor - Xchecked via VT: be4eb726c8dd8b554e143816b739cbddf9fcf9fd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1daf50692afc8381e3fccb1019f53806c9d997487f4c17025c14a8d0bfca230f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379f-dea4-4627-8223-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:55.000Z",
|
||
|
|
"description": "Repezor - Xchecked via VT: be4eb726c8dd8b554e143816b739cbddf9fcf9fd",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1b2f5f1e404149615c160d07f041945c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a379f-d888-4eac-b43f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:55.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:55Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a379f-d888-4eac-b43f-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a379f-d888-4eac-b43f-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1daf50692afc8381e3fccb1019f53806c9d997487f4c17025c14a8d0bfca230f/analysis/1433906769/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a379f-8d7c-4741-be91-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:55.000Z",
|
||
|
|
"description": "Ransom - Xchecked via VT: e444378c08984b8c8089bd6d2328c4f2edc2ee2d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '598017df43669e5f0c2e74a86a5f99b030eb7f3c660b06f89892dfcecdb3607e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a0-9718-46bc-a40b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:56.000Z",
|
||
|
|
"description": "Ransom - Xchecked via VT: e444378c08984b8c8089bd6d2328c4f2edc2ee2d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5d1a353e9b9c3494813d763a8c410838']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a0-1068-4458-94c7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:56.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:56Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a0-1068-4458-94c7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a0-1068-4458-94c7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/598017df43669e5f0c2e74a86a5f99b030eb7f3c660b06f89892dfcecdb3607e/analysis/1430932405/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a0-4cdc-4a24-9a82-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:56.000Z",
|
||
|
|
"description": "Peaac - Xchecked via VT: f736dbf5941dcd4455a396cfce5444d21f922c71",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5b8678a9e45e921e5b8333fd0a909718a898ac4f758066e0f12f9b50c9c26f47']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a1-609c-4b9d-b225-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:57.000Z",
|
||
|
|
"description": "Peaac - Xchecked via VT: f736dbf5941dcd4455a396cfce5444d21f922c71",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3bc32a724a0834dba2ce090cece0b897']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a1-ebdc-445c-9d06-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:57.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:57Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a1-ebdc-445c-9d06-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a1-ebdc-445c-9d06-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5b8678a9e45e921e5b8333fd0a909718a898ac4f758066e0f12f9b50c9c26f47/analysis/1441347440/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a1-a34c-44db-b278-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:57.000Z",
|
||
|
|
"description": "Omaneat - Xchecked via VT: e2021957bcd4021aa1cf0504fd065b9d575ca333",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3b432c79a4d9e1db8c097a905e4020e6ec03d77fb969f2a037f99f60b52d20e4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a2-f320-443a-af55-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:58.000Z",
|
||
|
|
"description": "Omaneat - Xchecked via VT: e2021957bcd4021aa1cf0504fd065b9d575ca333",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2fe1fdf495889b4f90f6855f628a10b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a2-668c-43fb-a610-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:58.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:58Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a2-668c-43fb-a610-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a2-668c-43fb-a610-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3b432c79a4d9e1db8c097a905e4020e6ec03d77fb969f2a037f99f60b52d20e4/analysis/1441216993/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a2-2a4c-4976-bfce-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:58.000Z",
|
||
|
|
"description": "Omaneat - Xchecked via VT: bde3bdfeb2c539be5ee4f68130df8206a3324e0e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0449158ef2aa6261f4506619cd11b9834605365f1038a0b49e6d1dea8cb81869']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a3-a07c-48b5-863c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:59.000Z",
|
||
|
|
"description": "Omaneat - Xchecked via VT: bde3bdfeb2c539be5ee4f68130df8206a3324e0e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '195ee1391d1ff6e55807bf148e515d23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a3-26c8-46eb-80df-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:59.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:02:59Z",
|
||
|
|
"last_observed": "2015-09-29T07:02:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a3-26c8-46eb-80df-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a3-26c8-46eb-80df-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0449158ef2aa6261f4506619cd11b9834605365f1038a0b49e6d1dea8cb81869/analysis/1443012350/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a3-d710-4544-bb33-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:02:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:02:59.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: fe8c933d0ad848cce6f05566146b28dc914cd9cd",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '464f32162245e34881f81ec0f1a1183202b06e97208abf8698efa4dcceadcf9d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:02:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a4-0290-4e58-b5d1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:00.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: fe8c933d0ad848cce6f05566146b28dc914cd9cd",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c00a8c974ed255151679e67db9277e97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a4-4424-423c-8587-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:00.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:00Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a4-4424-423c-8587-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a4-4424-423c-8587-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/464f32162245e34881f81ec0f1a1183202b06e97208abf8698efa4dcceadcf9d/analysis/1430932418/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a4-9248-4c4d-b16a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:00.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: fe351e852c74170cac5ab3271e4da55eb413ad02",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd50a229af2c2a23c56ef96deea1cfba041a595789381688b1470ed4ba7dc5166']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a5-5ff0-477a-9a52-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:01.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: fe351e852c74170cac5ab3271e4da55eb413ad02",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b1a85fbf74702a5b436043261c584a3d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a5-b1f8-4eb6-ad23-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:01.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:01Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a5-b1f8-4eb6-ad23-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a5-b1f8-4eb6-ad23-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d50a229af2c2a23c56ef96deea1cfba041a595789381688b1470ed4ba7dc5166/analysis/1421841911/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a6-4034-4c71-a73f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:02.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: ee10d8d24d627a4251be10d8958f9b74b104b7d4",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f616159b1a715c907887aa07e6ebb9d6878f4c02a435d4649a4782333d384959']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a6-69f8-4c75-81c3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:02.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: ee10d8d24d627a4251be10d8958f9b74b104b7d4",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f0e292ef3cbb3542cdcf52bd0448a0cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a6-3828-42a6-9008-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:02.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:02Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a6-3828-42a6-9008-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a6-3828-42a6-9008-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f616159b1a715c907887aa07e6ebb9d6878f4c02a435d4649a4782333d384959/analysis/1441347369/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a7-e0e0-4f7d-9ebf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:03.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: c931c0a9e689fad266dc2d3d10b1f5d81f642eba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '171fc6d8363c0bd35adae4d72c46cf107726de66c53f7c474e416ca6ba3ec4a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a7-6ba0-43d5-9362-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:03.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: c931c0a9e689fad266dc2d3d10b1f5d81f642eba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6f8ff40aa940363020aff30de6572a69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a7-08a4-4787-9363-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:03.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:03Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a7-08a4-4787-9363-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a7-08a4-4787-9363-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/171fc6d8363c0bd35adae4d72c46cf107726de66c53f7c474e416ca6ba3ec4a7/analysis/1430932416/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a8-2bd8-483c-87a2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:04.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: c8f3087c1a5ea390fab3e0e6124734f69367d5d7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95c1789a6b61995cc71c56277ca7faf07ff4371b418c2fcd52e6e91205128a0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a8-03a0-4db3-b297-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:04.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: c8f3087c1a5ea390fab3e0e6124734f69367d5d7",
|
||
|
|
"pattern": "[file:hashes.MD5 = '04061f6e1a0463131ed129bcb03003d5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a8-0e2c-41d6-bf7d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:04.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:04Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a8-0e2c-41d6-bf7d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a8-0e2c-41d6-bf7d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/95c1789a6b61995cc71c56277ca7faf07ff4371b418c2fcd52e6e91205128a0e/analysis/1430932436/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a9-52b4-479a-adb5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:05.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: a0124d2b3d9e1a7bb79a5f590bd00e24eb6662ac",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'aaba42de56fe956c691d68a5e9352231ede81098eb6cf6488f1789f495792abf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37a9-0ce8-4afa-a834-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:05.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: a0124d2b3d9e1a7bb79a5f590bd00e24eb6662ac",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7cccf8a87b92d7f0c430951c7748d7fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37a9-b13c-4b3a-b99c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:05.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:05Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37a9-b13c-4b3a-b99c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37a9-b13c-4b3a-b99c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/aaba42de56fe956c691d68a5e9352231ede81098eb6cf6488f1789f495792abf/analysis/1443502953/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37aa-9eec-442e-9e0b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:06.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 9e3b077293bebc745ed3b3b4bf6d7916f1a609db",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'dc5afa1ae0983e1246969ee65e266fc6f7781d9fe287157df69959ff93814c69']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37aa-5f14-47de-839d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:06.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 9e3b077293bebc745ed3b3b4bf6d7916f1a609db",
|
||
|
|
"pattern": "[file:hashes.MD5 = '57a8db5a5d35464be16518332a64a992']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37aa-5a70-40ab-85b2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:06.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:06Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37aa-5a70-40ab-85b2-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37aa-5a70-40ab-85b2-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/dc5afa1ae0983e1246969ee65e266fc6f7781d9fe287157df69959ff93814c69/analysis/1430932433/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ab-a100-4d10-a8f0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:07.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 93ebf964c992148672861adcc49b88096476a516",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e41c02c7d73e25d0423e54de535b6067a642ce0e4ef7cbe19429ef16dec596a2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ab-8570-465c-a006-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:07.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 93ebf964c992148672861adcc49b88096476a516",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cba775510ffa89c3d3e61e7384b8a300']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ab-a230-43e7-9e07-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:07.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:07Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ab-a230-43e7-9e07-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ab-a230-43e7-9e07-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e41c02c7d73e25d0423e54de535b6067a642ce0e4ef7cbe19429ef16dec596a2/analysis/1430932432/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ac-2f6c-4ace-a50f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:08.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 6e414d26146d9e33c690f9e482c59b87184575f6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '52718db49847c3eab095e4121d83bad43217e153f1f5842526c3636bdf952d15']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ac-ddd8-4b24-8d70-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:08.000Z",
|
||
|
|
"description": "NetWiredRC - Xchecked via VT: 6e414d26146d9e33c690f9e482c59b87184575f6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b89b78ac0070ca1ce5682464acdbf2ab']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ad-06c4-4ad4-9145-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:09.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:09Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ad-06c4-4ad4-9145-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ad-06c4-4ad4-9145-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/52718db49847c3eab095e4121d83bad43217e153f1f5842526c3636bdf952d15/analysis/1443092956/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ad-7208-45f3-89cb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:09.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: f8e53b776d0eee4f824eaa3cdb1b0b1bb186437d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '894ed0c7264421e2fb9db850f55aa5309be066f74547893d028a934c61da37ff']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ad-89c4-4186-8ede-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:09.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: f8e53b776d0eee4f824eaa3cdb1b0b1bb186437d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7a58cb14fad3cc1a226db370e266eb88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ae-8758-436a-b8b6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:10.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:10Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ae-8758-436a-b8b6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ae-8758-436a-b8b6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/894ed0c7264421e2fb9db850f55aa5309be066f74547893d028a934c61da37ff/analysis/1441216652/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ae-65e0-4b28-b19d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:10.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: eaf648a422b2edf0184af296845be8bbf0d8fc6d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1960211e289dcccda03b13ec8a3f2ae575033516f92983a513b269c5b2de02a2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ae-bb1c-47d8-b3f4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:10.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: eaf648a422b2edf0184af296845be8bbf0d8fc6d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '77189d817d08d0f558e63d173b6f8756']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37af-98c8-400c-960b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:11.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:11Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37af-98c8-400c-960b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37af-98c8-400c-960b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1960211e289dcccda03b13ec8a3f2ae575033516f92983a513b269c5b2de02a2/analysis/1441346849/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37af-86b4-47f6-b3a6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:11.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: e01bf8c25aacdb56a460f01832c0a0285a17949f",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0aad09bd527c1e9982059194e619c8e57faf4e7e65208f9e936af192b3b4e65a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37af-5860-4336-b180-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:11.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: e01bf8c25aacdb56a460f01832c0a0285a17949f",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fc6ace83e2855f675d1c0f59a69e186b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b0-23a4-419e-b6df-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:12.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:12Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b0-23a4-419e-b6df-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b0-23a4-419e-b6df-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0aad09bd527c1e9982059194e619c8e57faf4e7e65208f9e936af192b3b4e65a/analysis/1443172423/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b0-cce8-4c8b-adf3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:12.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: b843d5781a55532e99d55ee03c23cc6342f121ae",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5640468923ddca2f8ca48524c56f708b84f12682b8d8b6664e438890dd268deb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b0-286c-4cf1-a997-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:12.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: b843d5781a55532e99d55ee03c23cc6342f121ae",
|
||
|
|
"pattern": "[file:hashes.MD5 = '22cfb59650c9e92f79f9fa876dc92e8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b1-3c3c-431e-94b0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:13.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:13Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b1-3c3c-431e-94b0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b1-3c3c-431e-94b0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5640468923ddca2f8ca48524c56f708b84f12682b8d8b6664e438890dd268deb/analysis/1440685207/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b1-d048-45cc-bd48-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:13.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: 9c8474f8c7e87328573c822cb73014117e32a633",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3356824cf458d55f911ef1bdcc0f1004967e8c6aa7c1958be5119e7e4cc307b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b1-01f0-4056-bb12-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:13.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: 9c8474f8c7e87328573c822cb73014117e32a633",
|
||
|
|
"pattern": "[file:hashes.MD5 = '10c6357e7d357c8eda03c347427efb1c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b2-4264-422a-9231-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:14.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:14Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b2-4264-422a-9231-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b2-4264-422a-9231-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3356824cf458d55f911ef1bdcc0f1004967e8c6aa7c1958be5119e7e4cc307b9/analysis/1443341600/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b2-31a8-4185-a192-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:14.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: 7d9035f66cd2bc7a1357954410b70e885c5527ba",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '87b0031cdf452042b9a20a8e0b8f496b23a489e4ae5f23fa653a2a6c5353df79']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b2-6328-496d-a086-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:14.000Z",
|
||
|
|
"description": "Limitail - Xchecked via VT: 7d9035f66cd2bc7a1357954410b70e885c5527ba",
|
||
|
|
"pattern": "[file:hashes.MD5 = '621e673c79047dfc99c7cf295c15ea15']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b3-673c-4866-8300-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:15.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:15Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b3-673c-4866-8300-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b3-673c-4866-8300-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/87b0031cdf452042b9a20a8e0b8f496b23a489e4ae5f23fa653a2a6c5353df79/analysis/1440497049/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b3-e47c-4281-a5cc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:15.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 18e0c75baa79355d24015acab0a6225bf9f75880",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8a95cf6fd818ad808bdfa31b2b99179044770d7ffadefa5ffa9fb98a2c314f06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b4-96ec-4eb5-9a81-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:16.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 18e0c75baa79355d24015acab0a6225bf9f75880",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e0d462b4119dca019372f1fc2cdb7897']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b4-ceb8-4a5b-9f22-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:16.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:16Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b4-ceb8-4a5b-9f22-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b4-ceb8-4a5b-9f22-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8a95cf6fd818ad808bdfa31b2b99179044770d7ffadefa5ffa9fb98a2c314f06/analysis/1430932405/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b4-9a78-4c5f-bf12-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:16.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 1633ae5ff2e74118806e2a73d3e3c5445283fb01",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c2d82bc29557f162acba1c62f41197cd4fe54643b7e2b54c4c9de7b744a0d7f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b5-23d0-4ac6-bb80-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:17.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 1633ae5ff2e74118806e2a73d3e3c5445283fb01",
|
||
|
|
"pattern": "[file:hashes.MD5 = '350535e0fdef5d312cf968162e5acc4e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b5-b954-4476-b806-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:17.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:17Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b5-b954-4476-b806-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b5-b954-4476-b806-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9c2d82bc29557f162acba1c62f41197cd4fe54643b7e2b54c4c9de7b744a0d7f/analysis/1432906482/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b5-35f0-40dc-83b5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:17.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 09c407767dee6a62b2f749ad42237a743d7041d0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6d7745097cb6558ae9717013b9b540594ac21856117430ece9de5c4687ae4555']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b6-62d4-4ef2-a744-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:18.000Z",
|
||
|
|
"description": "Kazy - Xchecked via VT: 09c407767dee6a62b2f749ad42237a743d7041d0",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e3124786031524a556c64ecbb3e05dbd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b6-f088-4790-afc6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:18.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:18Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b6-f088-4790-afc6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b6-f088-4790-afc6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6d7745097cb6558ae9717013b9b540594ac21856117430ece9de5c4687ae4555/analysis/1430932422/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b6-fa58-4e61-b8b0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:18.000Z",
|
||
|
|
"description": "Kasidet - Xchecked via VT: b9464ea94140dbacceda95256d2c8de7baf2b3b1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c60dd39f46a8913ce4b44dd5db335aecd83d808b99b05e0ad660dd8a47d498eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b7-8cec-463f-b1b2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:19.000Z",
|
||
|
|
"description": "Kasidet - Xchecked via VT: b9464ea94140dbacceda95256d2c8de7baf2b3b1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0448bfe50bc8c3c340bc7cf3b054c013']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b7-ff64-4d2f-84f8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:19.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:19Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b7-ff64-4d2f-84f8-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b7-ff64-4d2f-84f8-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c60dd39f46a8913ce4b44dd5db335aecd83d808b99b05e0ad660dd8a47d498eb/analysis/1430378532/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b7-a76c-43ee-bad5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:19.000Z",
|
||
|
|
"description": "Kasidet - Xchecked via VT: 4da12a7730301073ab634b6a597a0d9c3902447d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '26dca95c78fca5db1e4ca9fbdebc3293a0f7b603a4a8ac3e66b02311737cea9d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b8-dbec-4ca7-b0fb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:20.000Z",
|
||
|
|
"description": "Kasidet - Xchecked via VT: 4da12a7730301073ab634b6a597a0d9c3902447d",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'def5b7605b639c9c88a901371afdf9fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b8-8388-4c5b-a569-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:20.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:20Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b8-8388-4c5b-a569-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b8-8388-4c5b-a569-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/26dca95c78fca5db1e4ca9fbdebc3293a0f7b603a4a8ac3e66b02311737cea9d/analysis/1439720831/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b8-b614-4cbb-85db-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:20.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: c17f283852e9054c5a99fab2ced81dcdb7717ae0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a1cb3d6d2d9e42c16463d27a8a5f81b23a644a040603bf8e3cab826f0d0bba07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b9-84c4-41c2-bc4a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:21.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: c17f283852e9054c5a99fab2ced81dcdb7717ae0",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ee5cf3eb714198e7fa1ed2991eac0ac1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37b9-013c-42dc-855a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:21.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:21Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37b9-013c-42dc-855a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37b9-013c-42dc-855a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a1cb3d6d2d9e42c16463d27a8a5f81b23a644a040603bf8e3cab826f0d0bba07/analysis/1441375537/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37b9-25dc-44f5-a50e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:21.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: bbb7e5d092f7e4a56cf0be51d1c586c61f63f44d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '86a8e95f2633bf9bb9c0a735e8d1543e5802315e3ccabb5e479c751785c524e0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ba-1870-4880-8b80-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:22.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: bbb7e5d092f7e4a56cf0be51d1c586c61f63f44d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0af2cbef2a756b8f3ba66a29ebc05762']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ba-6390-4a18-82f8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:22.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:22Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ba-6390-4a18-82f8-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ba-6390-4a18-82f8-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/86a8e95f2633bf9bb9c0a735e8d1543e5802315e3ccabb5e479c751785c524e0/analysis/1441580894/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bb-4068-4f90-a910-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:23.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: bb33f094b2f9c940b25518efcb9eb1dc38612be8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e38219d802ffec6d0273d3034617a2386fb6f778c0fea9f6ba9c18c0877cbc4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bb-d80c-4fd0-a86c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:23.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: bb33f094b2f9c940b25518efcb9eb1dc38612be8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4c2b5b15bd372d3ea88991d1562b0d8a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37bb-dd94-4510-8ed7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:23.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:23Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37bb-dd94-4510-8ed7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37bb-dd94-4510-8ed7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2e38219d802ffec6d0273d3034617a2386fb6f778c0fea9f6ba9c18c0877cbc4/analysis/1435957710/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bc-dd74-4e56-9c28-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:24.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: b724a030ef3d3ca5aacba76c11bbeb72193f7558",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e3fd1cbfe5baf1aeb0b12eb5b685e3bc63084221b60b36d17d0e7d73af984fc5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bc-8130-4250-bf79-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:24.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: b724a030ef3d3ca5aacba76c11bbeb72193f7558",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1692767d1adeeb3597181295c461ccb2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37bc-99e0-480c-898c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:24.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:24Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37bc-99e0-480c-898c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37bc-99e0-480c-898c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e3fd1cbfe5baf1aeb0b12eb5b685e3bc63084221b60b36d17d0e7d73af984fc5/analysis/1435812458/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bd-9ff8-4e1b-8d62-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:25.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 8afd513d177f99fe4ef95ba5a26c009f9e48b637",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '304749a81a3ecba5adcc39dc135232d8f47845e1e13d0de3e92a23334eb80241']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bd-2250-4a7c-9f6f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:25.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 8afd513d177f99fe4ef95ba5a26c009f9e48b637",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c238c2293264428f197c2d6052c34347']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37bd-2d1c-43f2-b797-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:25.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:25Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37bd-2d1c-43f2-b797-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37bd-2d1c-43f2-b797-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/304749a81a3ecba5adcc39dc135232d8f47845e1e13d0de3e92a23334eb80241/analysis/1437665234/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37be-ec8c-4b91-8a2f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:26.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 80ac4199c7c519cbbcc04087a684b776cfe2b24a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9a4372889530776df79b3ce0093ac594d1d0f86dc952c0f2ea8e05929f426128']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37be-f0f4-4a1b-b93b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:26.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 80ac4199c7c519cbbcc04087a684b776cfe2b24a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2c379f052684e21736c029e0057bb9c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37be-5c9c-4633-be41-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:26.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:26Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37be-5c9c-4633-be41-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37be-5c9c-4633-be41-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9a4372889530776df79b3ce0093ac594d1d0f86dc952c0f2ea8e05929f426128/analysis/1443103852/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bf-9280-4ee0-8e88-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:27.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 6457c9efabaefee75ba950f7c93d89f921b22663",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '11868fe071ce7e3ae7960eed8d0c8342a873cefb77f114823d9512c56ba3e9fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37bf-18bc-49db-8eed-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:27.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 6457c9efabaefee75ba950f7c93d89f921b22663",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd8cabde1874b60f4b116997c0307faaf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37bf-c340-4636-af9a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:27.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:27Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37bf-c340-4636-af9a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37bf-c340-4636-af9a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/11868fe071ce7e3ae7960eed8d0c8342a873cefb77f114823d9512c56ba3e9fb/analysis/1443081268/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c0-c528-4de0-b787-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:28.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 5cc410e31e5e84e980039e99cae47cbabae85a5c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1423115d6af552e2ccf639aafe533bf08c86431925e85ea30543116baa3afd61']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c0-a3b0-402f-9814-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:28.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 5cc410e31e5e84e980039e99cae47cbabae85a5c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '20024727cb8465bd0107f2757beabe71']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c1-2c90-4cde-a665-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:29.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:29Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c1-2c90-4cde-a665-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c1-2c90-4cde-a665-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1423115d6af552e2ccf639aafe533bf08c86431925e85ea30543116baa3afd61/analysis/1438047590/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c1-ddc0-4c6f-b0ae-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:29.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 54b8085a371d63eba486136730d1c3ad303c3693",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8fb1827e75c8f31527d59f51e6d801f733d78ee05a155f91cb8f1e15dca058cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c1-7230-4e32-90eb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:29.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 54b8085a371d63eba486136730d1c3ad303c3693",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7eba03d827af37df43cecd02de8d84e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c2-4b7c-4fe7-b533-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:30.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:30Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c2-4b7c-4fe7-b533-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c2-4b7c-4fe7-b533-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8fb1827e75c8f31527d59f51e6d801f733d78ee05a155f91cb8f1e15dca058cb/analysis/1442915641/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c2-3a00-41c5-afd3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:30.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 3b6efeb322fc464086e7daaa54398ac1ceef4bff",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3928f06924ead11119f1ab66e989673f313db8eba8f26ecf184de6fecbbd53f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c2-fd54-4f81-9496-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:30.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 3b6efeb322fc464086e7daaa54398ac1ceef4bff",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0453090c5d689b383d55d2333da3dd74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c3-1a48-49eb-a486-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:31.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:31Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c3-1a48-49eb-a486-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c3-1a48-49eb-a486-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3928f06924ead11119f1ab66e989673f313db8eba8f26ecf184de6fecbbd53f6/analysis/1441697359/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c3-71f8-4921-9224-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:31.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 386d40d972a74729d20d6e95b6ab5ffd4c8b7bec",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7f8d8dc96b2286aed89c4413a9c35db261201dc0f778c71245ff7c7870eddd0c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c3-99f8-445d-a162-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:31.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 386d40d972a74729d20d6e95b6ab5ffd4c8b7bec",
|
||
|
|
"pattern": "[file:hashes.MD5 = '578bcbf6b92889cad5f768c36ed4f364']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c4-f4e4-4b02-a7b5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:32.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:32Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c4-f4e4-4b02-a7b5-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c4-f4e4-4b02-a7b5-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7f8d8dc96b2286aed89c4413a9c35db261201dc0f778c71245ff7c7870eddd0c/analysis/1439590418/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c4-0338-4a53-93f7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:32.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 343b3546cff0b52065b354e24a8370b65874f8a1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5c65e4fd55df82f2f3997efc71b94dafa40bfbd46efbdf637f89418d14930d73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c4-b9ec-4205-904d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:32.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 343b3546cff0b52065b354e24a8370b65874f8a1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '5339fea1be50c976869490fccdf8601a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c5-89d0-480f-b788-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:33.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:33Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c5-89d0-480f-b788-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c5-89d0-480f-b788-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5c65e4fd55df82f2f3997efc71b94dafa40bfbd46efbdf637f89418d14930d73/analysis/1441299068/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c5-74d8-498e-8347-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:33.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 27f59ac9b5796b46bb13cf9dc85bb5e8893a96d5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '306dd121c6895ca7e62105f537efa6c22912ddcb0f649ebd8b982f260416d7c1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c5-0da4-4858-85d0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:33.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 27f59ac9b5796b46bb13cf9dc85bb5e8893a96d5",
|
||
|
|
"pattern": "[file:hashes.MD5 = '10e2e45c11c61ec90ac886a09dc73101']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c6-d500-45e8-9ded-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:34.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:34Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c6-d500-45e8-9ded-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c6-d500-45e8-9ded-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/306dd121c6895ca7e62105f537efa6c22912ddcb0f649ebd8b982f260416d7c1/analysis/1434737626/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c6-56b4-468d-9107-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:34.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 05468cb85b2ef4f63ffc2256414eb984315e7600",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2f9d91e82c21ac9c73002b30e5f4dcbadb765d79b79d4a17b6ff7769c3a25010']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c6-b14c-41e9-8a06-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:34.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 05468cb85b2ef4f63ffc2256414eb984315e7600",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bc89576e53c103710ca9e1bcbfbd05cb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c7-3138-421e-975f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:35.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:35Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c7-3138-421e-975f-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c7-3138-421e-975f-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2f9d91e82c21ac9c73002b30e5f4dcbadb765d79b79d4a17b6ff7769c3a25010/analysis/1439349591/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c7-a6d0-491f-8e8f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:35.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 038edf0b0bc3faec0c9c8c291fd9f1ac509383d1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6c4f451f8678173dfa5a56161fedb1b6a7983fa6f0eaa17f04de0552efea9dac']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c8-2518-492b-8a5d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:36.000Z",
|
||
|
|
"description": "Heye - Xchecked via VT: 038edf0b0bc3faec0c9c8c291fd9f1ac509383d1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d107b7ab41dadfcf57b2d0c1375c48d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c8-6248-4044-92a4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:36.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:36Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:36Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c8-6248-4044-92a4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c8-6248-4044-92a4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6c4f451f8678173dfa5a56161fedb1b6a7983fa6f0eaa17f04de0552efea9dac/analysis/1440322506/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c8-29b8-4cb2-ab71-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:36.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 93e5d0166a32ec616cdb66a9ae68cc1b0799e2a6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2c5401fc391b9bc007ba0121f69e6634cd8f73a1c16d9475ed58f5246e4e1456']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c9-18e4-4c38-bc99-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:37.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 93e5d0166a32ec616cdb66a9ae68cc1b0799e2a6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8df0036db63bb2d02b98927e7520acf0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37c9-6524-459b-9663-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:37.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:37Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37c9-6524-459b-9663-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37c9-6524-459b-9663-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2c5401fc391b9bc007ba0121f69e6634cd8f73a1c16d9475ed58f5246e4e1456/analysis/1430932414/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37c9-adc0-4c5f-bc57-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:37.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 9331eadbe9fe620f2b6232cb79ddc83457e49653",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7ca75b14cfae9d1ca00b4a9e6d902cfc424740514e364db767aa90c68ac8ca6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ca-0110-40cf-8d8a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:38.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 9331eadbe9fe620f2b6232cb79ddc83457e49653",
|
||
|
|
"pattern": "[file:hashes.MD5 = '453f48485edd90d1ab2a3063682931d6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ca-4d88-4958-9bd2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:38.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:38Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ca-4d88-4958-9bd2-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ca-4d88-4958-9bd2-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7ca75b14cfae9d1ca00b4a9e6d902cfc424740514e364db767aa90c68ac8ca6f/analysis/1443336085/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ca-0330-4abf-a977-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:38.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 92f8ae6e382e8505154f35bfcc540a8393d79648",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f218dec611b76fef61ebab76d8e8f7200e0971e68d3849fab95fa329d3c61cd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cb-5694-48b3-93e4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:39.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 92f8ae6e382e8505154f35bfcc540a8393d79648",
|
||
|
|
"pattern": "[file:hashes.MD5 = '66f15bec5c78e74aea8321dd7c4d67ae']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37cb-f050-4c8a-9659-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:39.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:39Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37cb-f050-4c8a-9659-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37cb-f050-4c8a-9659-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3f218dec611b76fef61ebab76d8e8f7200e0971e68d3849fab95fa329d3c61cd/analysis/1427972808/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cb-7dd0-4480-bf10-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:39.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 8e0a25c8394d66a10f86b06fc0b2d6a738e8f1b1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6e5876cae1b0e5fbe329978ade3fb0cf85c9ae19a8962308ff4e8a57c2487688']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cc-ef3c-4024-86d1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:40.000Z",
|
||
|
|
"description": "Gamarue - Xchecked via VT: 8e0a25c8394d66a10f86b06fc0b2d6a738e8f1b1",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0ca4f33beb004d1be9485040797bed27']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37cc-3e68-45a6-9a74-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:40.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:40Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37cc-3e68-45a6-9a74-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37cc-3e68-45a6-9a74-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6e5876cae1b0e5fbe329978ade3fb0cf85c9ae19a8962308ff4e8a57c2487688/analysis/1443392077/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cc-5eb8-4854-b27f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:40.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 9d6d9fc05ce8e386113b971d8f4c8612832e8e48",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e843fc5f139b15da4ed896e6b157b95f0f6cd59e8a57640e731f1e0e570d34a7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cd-6968-4b7f-8b28-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:41.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 9d6d9fc05ce8e386113b971d8f4c8612832e8e48",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3c262b85fe8c845ee7d86c7f7ed50077']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37cd-340c-4e01-baa6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:41.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:41Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37cd-340c-4e01-baa6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37cd-340c-4e01-baa6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e843fc5f139b15da4ed896e6b157b95f0f6cd59e8a57640e731f1e0e570d34a7/analysis/1443342017/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cd-3984-4f8e-9fc9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:41.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 99ba488f515ce4837dadfee6ea99c0d85a27095c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c0d2dc9d4f3104ce80561d9cf33819d7c5fbc0a9d7943dbbcaf82624b2c10115']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ce-7828-4116-ad4b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:42.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 99ba488f515ce4837dadfee6ea99c0d85a27095c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e1bd8730eb346ccd8c78ae760c877524']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ce-b518-4cfb-8c8c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:42.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:42Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ce-b518-4cfb-8c8c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ce-b518-4cfb-8c8c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c0d2dc9d4f3104ce80561d9cf33819d7c5fbc0a9d7943dbbcaf82624b2c10115/analysis/1443339913/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cf-8864-4118-bfcb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:43.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 97b22531422950658c06e6412a8670a2e6971bd1",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ef3a3e734102450e540310cc167038d40ae35bb23bb60b7cc53ec25fb39ba2be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37cf-b660-4b80-b837-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:43.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 97b22531422950658c06e6412a8670a2e6971bd1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e215dd49ee49ecfe40ada964d23c8462']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37cf-c7cc-4d8c-9632-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:43.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:43Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37cf-c7cc-4d8c-9632-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37cf-c7cc-4d8c-9632-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ef3a3e734102450e540310cc167038d40ae35bb23bb60b7cc53ec25fb39ba2be/analysis/1443339172/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d0-a768-4d77-95d1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:44.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 96ed7a1071595ccd96b1ab7bd7fbb751262ef1ce",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd2d00f0c05f45093d15e394e0ff30e1ffe81694e15f718369504b0c65f0547f6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d0-888c-442a-b3bb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:44.000Z",
|
||
|
|
"description": "Fsysna - Xchecked via VT: 96ed7a1071595ccd96b1ab7bd7fbb751262ef1ce",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d954996e1ebc295c8834450bf695ab2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d0-f710-409d-8bdf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:44.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:44Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d0-f710-409d-8bdf-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d0-f710-409d-8bdf-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d2d00f0c05f45093d15e394e0ff30e1ffe81694e15f718369504b0c65f0547f6/analysis/1430932413/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d1-e000-4ec1-a42d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:45.000Z",
|
||
|
|
"description": "Evotob - Xchecked via VT: 40df05a0a872f92371ea315af786746d84342837",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '16f39cf316258b4983662a6bd928e6612fabd58010a8689da6591b2959a8967c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d1-dcbc-4af3-9df4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:45.000Z",
|
||
|
|
"description": "Evotob - Xchecked via VT: 40df05a0a872f92371ea315af786746d84342837",
|
||
|
|
"pattern": "[file:hashes.MD5 = '01992b00499e795f02a4dc2f4707b06e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d1-9a6c-4bb3-bcc3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:45.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:45Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d1-9a6c-4bb3-bcc3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d1-9a6c-4bb3-bcc3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/16f39cf316258b4983662a6bd928e6612fabd58010a8689da6591b2959a8967c/analysis/1441709696/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d2-3ed8-4575-ad00-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:46.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: b08f351c228ff246d29f548ef910fe6e58c83caf",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '95d2eb217377842d1454745364f4a2678645d88a72004e6929ac4b9531ba3019']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d2-dbe8-49b1-abdb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:46.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: b08f351c228ff246d29f548ef910fe6e58c83caf",
|
||
|
|
"pattern": "[file:hashes.MD5 = '56b2227ce5ce8e82eb93e70191a5efaf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d2-bf70-466d-8cc6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:46.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:46Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d2-bf70-466d-8cc6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d2-bf70-466d-8cc6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/95d2eb217377842d1454745364f4a2678645d88a72004e6929ac4b9531ba3019/analysis/1430932419/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d3-4104-4a91-aca1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:47.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: 7bb6ea632a9944ee90fc2714a362c19451ea0e36",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e1552f04ca253e3910d0b3fa0e96bca3ce43561c2cb53162bad1436b4d5f0de5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d3-2ab4-4149-b10a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:47.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: 7bb6ea632a9944ee90fc2714a362c19451ea0e36",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9fbb8d4136ad263459cdbd51644ee657']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d3-7f88-4e67-9051-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:47.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:47Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d3-7f88-4e67-9051-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d3-7f88-4e67-9051-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e1552f04ca253e3910d0b3fa0e96bca3ce43561c2cb53162bad1436b4d5f0de5/analysis/1443099561/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d4-fc48-4cb5-8edc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:48.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: 2c378afb16742b138f8e5f35887687f98a3bfc14",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9353aea1a5a92894586958e7f2679bee997593faafe5b8839bfbb168e152ce11']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d4-c480-4acb-b047-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:48.000Z",
|
||
|
|
"description": "Dyzap - Xchecked via VT: 2c378afb16742b138f8e5f35887687f98a3bfc14",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3a0811b42b10b876b250ba8f7950456a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d4-b3f8-40b7-b919-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:48.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:48Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d4-b3f8-40b7-b919-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d4-b3f8-40b7-b919-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9353aea1a5a92894586958e7f2679bee997593faafe5b8839bfbb168e152ce11/analysis/1438622032/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d5-a78c-41aa-930c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:49.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: e9500ba8ee71d28a85fe375fb1859e32a62e5d8b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f1bae5c96550046921db54446593a1f626473c42f3bb815aa510eebf7445c03c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d5-f018-4859-86af-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:49.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: e9500ba8ee71d28a85fe375fb1859e32a62e5d8b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2e1d0b92f4b941bb9aa05a07bdf9ec84']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d6-1c58-44f7-b059-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:49.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:49Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d6-1c58-44f7-b059-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d6-1c58-44f7-b059-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f1bae5c96550046921db54446593a1f626473c42f3bb815aa510eebf7445c03c/analysis/1441348093/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d6-d7dc-4a9f-8a52-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:50.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: d86a1e65fef99f9ac75185d25ba0a318d25eaf95",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '90f4424dc59dbb05d1fd81428319eeaeca9db349525234c453160a89d1e7ed75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d6-e050-4d2b-9618-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:50.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: d86a1e65fef99f9ac75185d25ba0a318d25eaf95",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9d964711ee832b5189c42f604e8be534']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d7-4aec-465d-ae04-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:51.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:51Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d7-4aec-465d-ae04-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d7-4aec-465d-ae04-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/90f4424dc59dbb05d1fd81428319eeaeca9db349525234c453160a89d1e7ed75/analysis/1438239340/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d7-4854-420f-993f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:51.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: 5b767e871485983c7c2c17cb8590cc2862d2a114",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2be9ef11652c36a6a2aafa595575f25c15eaa80df54efb13ae92efe114f65ea9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d7-fcc4-4106-9530-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:51.000Z",
|
||
|
|
"description": "Dyreza - Xchecked via VT: 5b767e871485983c7c2c17cb8590cc2862d2a114",
|
||
|
|
"pattern": "[file:hashes.MD5 = '310085a50df76f4332b1773b81960998']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d8-009c-4bcc-acf2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:52.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:52Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d8-009c-4bcc-acf2-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d8-009c-4bcc-acf2-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2be9ef11652c36a6a2aafa595575f25c15eaa80df54efb13ae92efe114f65ea9/analysis/1437103382/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d8-e400-44d2-a7e0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:52.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: b0dabad6620c51ff033a95b2ba33159b30300fc6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b7c8eb1ecd89d3f3160d6a13e8b0971e657941976f4d1328c35e7de315e1d94']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d8-a7bc-45e8-b20f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:52.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: b0dabad6620c51ff033a95b2ba33159b30300fc6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c9ac13a4b310ff085d2fa59b10f9878']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37d9-0e00-4600-8c0b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:53.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:53Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37d9-0e00-4600-8c0b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37d9-0e00-4600-8c0b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0b7c8eb1ecd89d3f3160d6a13e8b0971e657941976f4d1328c35e7de315e1d94/analysis/1438870030/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d9-0488-403a-b402-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:53.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: af02552de3c5416171eac99929c9e90c06903bbe",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9386aaca449807b252f1afa3fcfe8cf86c7701c371d456a70452b0a27e9c8921']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37d9-c528-406c-8681-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:53.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: af02552de3c5416171eac99929c9e90c06903bbe",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c3f2330765f785bf6a691d5a78d8d9e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37da-ee74-42b6-8646-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:54.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:54Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37da-ee74-42b6-8646-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37da-ee74-42b6-8646-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9386aaca449807b252f1afa3fcfe8cf86c7701c371d456a70452b0a27e9c8921/analysis/1434618350/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37da-8090-4e4c-befc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:54.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: 806bfe6ec07ae33a457abef400c66b3dee639de9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f732f37e9328f7631f5b753bc23d6c79336b371c4a6c438171f0e2f6cce6e167']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37da-8194-4b6e-a507-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:54.000Z",
|
||
|
|
"description": "Dofoil - Xchecked via VT: 806bfe6ec07ae33a457abef400c66b3dee639de9",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ffcf4e833f1e872b046992fd1b020343']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37db-bef4-4bcf-aabf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:55.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:55Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37db-bef4-4bcf-aabf-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37db-bef4-4bcf-aabf-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f732f37e9328f7631f5b753bc23d6c79336b371c4a6c438171f0e2f6cce6e167/analysis/1443102872/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37db-3e38-48aa-9586-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:55.000Z",
|
||
|
|
"description": "Delf - Xchecked via VT: 9aab25b9c2cfcadab4b5ad6097eab864782ad839",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd1da1fbed7249980f3f1d81a0daf6eb0312f8896bd65991cc512ecc72d61b980']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37db-67c8-4a93-a1fe-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:55.000Z",
|
||
|
|
"description": "Delf - Xchecked via VT: 9aab25b9c2cfcadab4b5ad6097eab864782ad839",
|
||
|
|
"pattern": "[file:hashes.MD5 = '455865ed6fe79e939bfb278db099afd9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37dc-4a0c-43af-be71-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:56.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:56Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37dc-4a0c-43af-be71-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37dc-4a0c-43af-be71-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d1da1fbed7249980f3f1d81a0daf6eb0312f8896bd65991cc512ecc72d61b980/analysis/1433818107/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37dc-3a3c-44f1-9792-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:56.000Z",
|
||
|
|
"description": "Delf - Xchecked via VT: 7e5785c49840dd093c3edd8c9aa9a6ede7efb789",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f25618b5db56e77e62967c3b398f37dd7d70bcc72a3a4e5c907dc13158866af']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37dd-05d4-422d-adc6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:56.000Z",
|
||
|
|
"description": "Delf - Xchecked via VT: 7e5785c49840dd093c3edd8c9aa9a6ede7efb789",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8aba1a0c895fa0680f6052c7a51d1a37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37dd-d0d8-4b87-b141-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:57.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:57Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37dd-d0d8-4b87-b141-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37dd-d0d8-4b87-b141-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3f25618b5db56e77e62967c3b398f37dd7d70bcc72a3a4e5c907dc13158866af/analysis/1443102602/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37dd-c79c-4a6d-8950-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:57.000Z",
|
||
|
|
"description": "CryptoWall - Xchecked via VT: 59aee2481fcb9f332e10eae4f3a2eb426416a05e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd6917d1b9087b3c5db5de15f0e3df9270a135ff5598b00438c667205e5b5dcb9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37de-af68-4c1f-a74c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:58.000Z",
|
||
|
|
"description": "CryptoWall - Xchecked via VT: 59aee2481fcb9f332e10eae4f3a2eb426416a05e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c8119d61c23f8b5807f9fe2659988eb5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37de-c0cc-4a74-ba47-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:58.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:58Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37de-c0cc-4a74-ba47-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37de-c0cc-4a74-ba47-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/d6917d1b9087b3c5db5de15f0e3df9270a135ff5598b00438c667205e5b5dcb9/analysis/1443074038/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37de-8af8-4ad1-816b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:58.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: aed9a8ed04f468bde9ee6a46f3d9ca002e6fa68b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ec71a7d66dfd4e365805d60138c77f1fc9ee3a50114a41d5f15d8ad24ce0d74f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37df-f568-44c9-8058-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:59.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: aed9a8ed04f468bde9ee6a46f3d9ca002e6fa68b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fb9954f4dcdc79f03eddad51ac05ff39']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37df-618c-4133-8a83-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:59.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:03:59Z",
|
||
|
|
"last_observed": "2015-09-29T07:03:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37df-618c-4133-8a83-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37df-618c-4133-8a83-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ec71a7d66dfd4e365805d60138c77f1fc9ee3a50114a41d5f15d8ad24ce0d74f/analysis/1431002394/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37df-1388-4872-94b6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:03:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:03:59.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: ae5569823536f52e90c0bf38037c339755abc86b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1ddaaf936f28867bbd43125ccaa24f13b8eb30bad58e8ab30e41d755d0154ade']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:03:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e0-f958-4c0d-90e5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:00.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: ae5569823536f52e90c0bf38037c339755abc86b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1c2f5fffa1026e8598f4ab58e492a048']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e0-b63c-4cca-aa65-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:00.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:00Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e0-b63c-4cca-aa65-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e0-b63c-4cca-aa65-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1ddaaf936f28867bbd43125ccaa24f13b8eb30bad58e8ab30e41d755d0154ade/analysis/1435213056/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e0-b508-4667-8119-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:00.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: 08b98d597329ad7500b5e0fc2aff9088a1476040",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '20e25213e52f5ab1d89d0cae5e6d1707fb2aec51f82a94a27a4dd0b8214c4504']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e1-0378-4430-83d6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:01.000Z",
|
||
|
|
"description": "Cromptui - Xchecked via VT: 08b98d597329ad7500b5e0fc2aff9088a1476040",
|
||
|
|
"pattern": "[file:hashes.MD5 = '25740a156ae9eeaf7e193f30b107b90a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e1-0fd4-49a8-b466-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:01.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:01Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e1-0fd4-49a8-b466-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e1-0fd4-49a8-b466-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/20e25213e52f5ab1d89d0cae5e6d1707fb2aec51f82a94a27a4dd0b8214c4504/analysis/1426770758/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e1-94fc-4544-aecb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:01.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: fa2fce48d55ad69574317b4a594824144b108c5b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e1b5dd2a55cd35d3210130177b977ca4aef1b49a5d9238c2795e795a1c6de9d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e2-2630-4515-8efa-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:02.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: fa2fce48d55ad69574317b4a594824144b108c5b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c91c3858c9a40b7bc79b51e1939a219a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e2-2b60-4dc1-8bd5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:02.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:02Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e2-2b60-4dc1-8bd5-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e2-2b60-4dc1-8bd5-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1e1b5dd2a55cd35d3210130177b977ca4aef1b49a5d9238c2795e795a1c6de9d/analysis/1430932442/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e2-dc10-476d-9e83-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:02.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f94a33bea170934331338e0614eb7106303a4bbe",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b75b42a8c224530ac1b777c01be6683dbf6d450dc8375b38ff89c5f4e3333ea9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e3-3510-469a-aa6c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:03.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f94a33bea170934331338e0614eb7106303a4bbe",
|
||
|
|
"pattern": "[file:hashes.MD5 = '338b5b86b8ee6df0cb68117fd59d623c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e3-b72c-4a5a-9c7a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:03.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:03Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e3-b72c-4a5a-9c7a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e3-b72c-4a5a-9c7a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b75b42a8c224530ac1b777c01be6683dbf6d450dc8375b38ff89c5f4e3333ea9/analysis/1441216652/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e3-5870-4996-968d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:03.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f3846775cb68d833370ce836b026e8280aebcc85",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98194e20628d8d6306e47b8d50713a78b501e52b5a437764c9f15ab97020b1ba']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e4-97cc-4b02-b8cf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:04.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f3846775cb68d833370ce836b026e8280aebcc85",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e5b80ec7501d5b33e3fee15543309b1a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e4-1e38-44d0-9913-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:04.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:04Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e4-1e38-44d0-9913-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e4-1e38-44d0-9913-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/98194e20628d8d6306e47b8d50713a78b501e52b5a437764c9f15ab97020b1ba/analysis/1441347016/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e5-31e8-41af-996a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:05.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f03568dbe213c8d437340f338ddaffee0de6ad8e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '51d17881bb9fe5c215d1346f2a6c6d5346cf5cfaf02983803597ac2529ef5927']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e5-9a28-4416-84d8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:05.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: f03568dbe213c8d437340f338ddaffee0de6ad8e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd27f8b66611fddead88a065d32c2c708']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e5-1074-4683-8330-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:05.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:05Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e5-1074-4683-8330-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e5-1074-4683-8330-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/51d17881bb9fe5c215d1346f2a6c6d5346cf5cfaf02983803597ac2529ef5927/analysis/1441347806/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e6-4268-4948-81be-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:06.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: e3346a91fce138cbba53b578c6cd514e0f652d84",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '190eae32e205db92aa72f7f3fe95e9d18b42e56e3d4ec3a0ecd82ed0994f23bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e6-e994-4754-89b7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:06.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: e3346a91fce138cbba53b578c6cd514e0f652d84",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3f152fae5920cfc96a0ad2a3a6a5e6c6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e6-2508-4467-8d8e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:06.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:06Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e6-2508-4467-8d8e-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e6-2508-4467-8d8e-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/190eae32e205db92aa72f7f3fe95e9d18b42e56e3d4ec3a0ecd82ed0994f23bd/analysis/1429720750/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e7-c598-487b-b6dd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:07.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: dbea117606fc7dcdfde00c70e21391ed7f433c73",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fedc59f2c6836c3a3d183b1466fda866cda4bd110daba36a8dde55821c07a30c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e7-a1b4-417c-9b2c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:07.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: dbea117606fc7dcdfde00c70e21391ed7f433c73",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bc457647c36f750f865cacaf3e3e7c32']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e7-1f74-48cd-952a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:07.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:07Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e7-1f74-48cd-952a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e7-1f74-48cd-952a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/fedc59f2c6836c3a3d183b1466fda866cda4bd110daba36a8dde55821c07a30c/analysis/1420888376/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e8-43dc-43ba-add3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:08.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d71e310adf183f02e36b06d166f8e3ad54fdbcc9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9b348d4c37e9f8ac0fb55894f12dae1400d16074a36419b9b01f7497f947e39a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e8-8060-4aaa-bf92-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:08.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d71e310adf183f02e36b06d166f8e3ad54fdbcc9",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1ccc42d38f5beb683d14a37fa2cb114']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e8-73bc-4527-b358-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:08.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:08Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e8-73bc-4527-b358-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e8-73bc-4527-b358-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9b348d4c37e9f8ac0fb55894f12dae1400d16074a36419b9b01f7497f947e39a/analysis/1441875301/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e9-0e04-48e5-918f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:09.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d71e2ec647b2e6811583d5f156da2d7769694926",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bb9b166f33425805796e73ab0653a3414bd1410756093afb704522c54be88e25']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37e9-25d0-4232-9f68-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:09.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d71e2ec647b2e6811583d5f156da2d7769694926",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6c4eaad12780802a6bc28d07b8015d82']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37e9-50b4-4a91-a826-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:09.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:09Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37e9-50b4-4a91-a826-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37e9-50b4-4a91-a826-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bb9b166f33425805796e73ab0653a3414bd1410756093afb704522c54be88e25/analysis/1441346721/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ea-9cc8-441f-9be5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:10.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d5d9abd1fe5a229de04efd1ab80fe986f038e4e6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6a39649bcc709e4b0637f0d75be2066431fc0bf064173c67206e42f2c276a444']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ea-bd44-4520-a396-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:10.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d5d9abd1fe5a229de04efd1ab80fe986f038e4e6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0b99a4fb7d356d895d3dec434f804740']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ea-a104-46ed-a673-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:10.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:10Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ea-a104-46ed-a673-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ea-a104-46ed-a673-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6a39649bcc709e4b0637f0d75be2066431fc0bf064173c67206e42f2c276a444/analysis/1430932439/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37eb-4194-4379-b78a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:11.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d596194a18da6dfce415f07acca9a3d3f8cd255b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f79e13ab48d2bf5840ac032803502fd3f7290138f699cec229f6483dc1dadf00']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37eb-c114-414b-a157-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:11.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d596194a18da6dfce415f07acca9a3d3f8cd255b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '39b9505929c90ff6a00830083d28dd48']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37eb-1c8c-4cbd-9768-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:11.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:11Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37eb-1c8c-4cbd-9768-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37eb-1c8c-4cbd-9768-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/f79e13ab48d2bf5840ac032803502fd3f7290138f699cec229f6483dc1dadf00/analysis/1441217002/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ec-f328-4ee5-9c0c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:12.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d2b20caa1320a208d8ca669e75c6fcb8b82e40f8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '093710554924b5c20e40c75d76fa461c1dcb708cc4706a83c8feef937a637d2a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ec-2bd4-4028-8ade-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:12.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: d2b20caa1320a208d8ca669e75c6fcb8b82e40f8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4cb64bd8b931cb99a1fecc3c08b175ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ed-6680-45a4-94f1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:13.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:13Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ed-6680-45a4-94f1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ed-6680-45a4-94f1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/093710554924b5c20e40c75d76fa461c1dcb708cc4706a83c8feef937a637d2a/analysis/1430932439/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ed-3908-4554-b346-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:13.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c66dacc233dd7df9b76280dd656d88adb25efa4c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2fcc46e4e34b77205adcd0023dd17a4bf4d54d23aafd0b0efcd3627511f392ed']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ed-071c-4184-838e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:13.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c66dacc233dd7df9b76280dd656d88adb25efa4c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '82af90c3854014f96fb53b1eedc2031d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ee-9e28-4edf-b349-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:14.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:14Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ee-9e28-4edf-b349-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ee-9e28-4edf-b349-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2fcc46e4e34b77205adcd0023dd17a4bf4d54d23aafd0b0efcd3627511f392ed/analysis/1436854404/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ee-8b34-4171-b48b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:14.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c64950e0a9fb72ba42ae4f96de84199268b19103",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a029dc7a4c4c4a14f3351a9ddc837995d10d40dce91b07017daba02ec13a7638']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ee-a518-4b06-8970-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:14.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c64950e0a9fb72ba42ae4f96de84199268b19103",
|
||
|
|
"pattern": "[file:hashes.MD5 = '178264cd9c338e97e35f62c1cf08f54e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ef-82c0-4171-855d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:15.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:15Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ef-82c0-4171-855d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ef-82c0-4171-855d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a029dc7a4c4c4a14f3351a9ddc837995d10d40dce91b07017daba02ec13a7638/analysis/1418301996/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ef-25b0-4bd4-aee3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:15.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c57f63364cbcf1a3b55feade869911785d1da5b9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '41e8f48490897cdaedffa0bf1e755e0f880783ff088aacd7b97ec441bfff6206']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ef-f48c-4768-bf21-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:15.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c57f63364cbcf1a3b55feade869911785d1da5b9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '86e48a9be62494bffb3b8e5ecb4a0310']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f0-25d0-4496-837b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:16.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:16Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f0-25d0-4496-837b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f0-25d0-4496-837b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/41e8f48490897cdaedffa0bf1e755e0f880783ff088aacd7b97ec441bfff6206/analysis/1442486944/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f0-2ca4-4447-87c0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:16.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c3de6b157847c117d2061db6d4a2550991c5c071",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5f1c425130d8c49eefc1285a0a368b40a1814957360ddad6a1f2f26d99267970']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f0-1444-428d-93e3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:16.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c3de6b157847c117d2061db6d4a2550991c5c071",
|
||
|
|
"pattern": "[file:hashes.MD5 = '34fd939ccb914638da169fcffeef9e77']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f1-2264-4d5a-b464-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:17.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:17Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f1-2264-4d5a-b464-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f1-2264-4d5a-b464-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5f1c425130d8c49eefc1285a0a368b40a1814957360ddad6a1f2f26d99267970/analysis/1442823567/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f1-e2d8-4821-a70c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:17.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c36c11c465120518b8b5818a9cc4e4a31d8d45ce",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '22a5ce047077f1d5b030324d54cc06aaab273db6df423328fb98965a11fd16c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f1-5c70-4740-b701-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:17.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c36c11c465120518b8b5818a9cc4e4a31d8d45ce",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd10b9b3658a396d7b4f3d86743c3183f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f2-2460-446b-adb0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:18.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:18Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f2-2460-446b-adb0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f2-2460-446b-adb0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/22a5ce047077f1d5b030324d54cc06aaab273db6df423328fb98965a11fd16c0/analysis/1430932417/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f2-38d8-4491-8c32-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:18.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c04ad61288df9a847311e7f94bf4a9d852d21724",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1e28a51efb3885a994dc10fb27455878712df3941a77745121e255c221bee622']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f2-333c-4c72-b0fd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:18.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c04ad61288df9a847311e7f94bf4a9d852d21724",
|
||
|
|
"pattern": "[file:hashes.MD5 = '45691956a1ba4a8ecc912aeb9f1f0612']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f3-7eb0-49b9-8ecc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:19.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:19Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f3-7eb0-49b9-8ecc-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f3-7eb0-49b9-8ecc-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1e28a51efb3885a994dc10fb27455878712df3941a77745121e255c221bee622/analysis/1442487012/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f3-fd30-470d-9130-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:19.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c003a53023eb4aba922784cf52b7c9054a0044f6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '46fbadf86c9e9a1490777607ce76fb0c217003a26db0a5a1d1ee42e7b72c440b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f3-58c4-4d77-8c81-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:19.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: c003a53023eb4aba922784cf52b7c9054a0044f6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1fec1a069c440d4343da2b45aa1c41b7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f4-2e20-4b5d-bae0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:20.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:20Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f4-2e20-4b5d-bae0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f4-2e20-4b5d-bae0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/46fbadf86c9e9a1490777607ce76fb0c217003a26db0a5a1d1ee42e7b72c440b/analysis/1415773826/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f4-08c0-4c99-8e60-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:20.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: bf2734a951bbb20e6738ad9c132b9ead0b5873a3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b26af97852040c087dfd6d88c26b91a78c3faf5ac93b9aedf5cbbc3c7a62b399']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f5-8ee0-4e6f-96ac-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:21.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: bf2734a951bbb20e6738ad9c132b9ead0b5873a3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '117930cad4937d16c1039ff1aab959c4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f5-43fc-41db-af46-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:21.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:21Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f5-43fc-41db-af46-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f5-43fc-41db-af46-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b26af97852040c087dfd6d88c26b91a78c3faf5ac93b9aedf5cbbc3c7a62b399/analysis/1442961746/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f5-863c-45fc-a0b8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:21.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a967748f295f16ac2b28521ab2b3efa210eda599",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7dd7a179bfabe3efb24e184e534b04b6649de94281542e1ccc50c459857fa129']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f6-2244-4b0f-a827-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:22.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a967748f295f16ac2b28521ab2b3efa210eda599",
|
||
|
|
"pattern": "[file:hashes.MD5 = '32954fe0e52ada01403bce9f7b808b89']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f6-cd94-4ace-a0a3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:22.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:22Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f6-cd94-4ace-a0a3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f6-cd94-4ace-a0a3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7dd7a179bfabe3efb24e184e534b04b6649de94281542e1ccc50c459857fa129/analysis/1415867010/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f6-06a0-41e4-8a51-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:22.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a8bf05dba97ef9fbb38ac77c1473e271acef2a75",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '09636cfe9d42e1cef88381f9def714fdd88ea847b0528467a42f797e1d107037']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f7-72d4-4915-b478-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:23.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a8bf05dba97ef9fbb38ac77c1473e271acef2a75",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6861fc68a7cb1064d12b11eba48721e6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f7-0cc4-4015-920c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:23.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:23Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f7-0cc4-4015-920c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f7-0cc4-4015-920c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/09636cfe9d42e1cef88381f9def714fdd88ea847b0528467a42f797e1d107037/analysis/1430932414/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f7-5a4c-437a-9eca-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:23.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a741ffda39b6864810d4118fde86f9535f4e0391",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0ed7f40fc572542bf5e307115f81768599a7d98b6081e16cc0f7b064b966770c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f8-8ae8-4475-9b2b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:24.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a741ffda39b6864810d4118fde86f9535f4e0391",
|
||
|
|
"pattern": "[file:hashes.MD5 = '342b8e57172776827dcc679b2d5da678']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f8-9a14-4eee-8dbb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:24.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:24Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f8-9a14-4eee-8dbb-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f8-9a14-4eee-8dbb-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/0ed7f40fc572542bf5e307115f81768599a7d98b6081e16cc0f7b064b966770c/analysis/1430932433/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f8-51c4-46cc-8e89-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:24.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a7006a278edcb15e7a01ff98cb22dd425a5ba679",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c5922534a78a9ee87a616c0fc44ba09068cb99ab89c61d9c06fdf547e1b4961c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f9-f978-4c9b-942e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:25.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: a7006a278edcb15e7a01ff98cb22dd425a5ba679",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8675c550f1d722b714e377273569a4f4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37f9-5e6c-48da-a5cd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:25.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:25Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:25Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37f9-5e6c-48da-a5cd-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37f9-5e6c-48da-a5cd-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c5922534a78a9ee87a616c0fc44ba09068cb99ab89c61d9c06fdf547e1b4961c/analysis/1430932434/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37f9-2f90-4864-baa4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:25.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 9fd58e04ced17f60c1ebfa8b862ab7af18b7984c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d51da6e1f7538096ccb22376b6da3ac602c7d557ad44174c7c46ca63eff122d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fa-2694-492b-ae84-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:26.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 9fd58e04ced17f60c1ebfa8b862ab7af18b7984c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c4a6a111a070856c49905d815f87ab49']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37fa-c734-4a75-8e39-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:26.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:26Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37fa-c734-4a75-8e39-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37fa-c734-4a75-8e39-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2d51da6e1f7538096ccb22376b6da3ac602c7d557ad44174c7c46ca63eff122d/analysis/1442486943/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fa-3f08-4c83-9a49-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:26.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8d58b05fcf96e3063afd1827d6e879ae08f6693b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '609b95302854274c8116fca0ebcb0bbd029afbc77329a96d9037158b5ba6dc3c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fb-ee54-49e6-9300-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:27.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8d58b05fcf96e3063afd1827d6e879ae08f6693b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c993726838b690ebd9fcb84e2fe6dee8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37fb-3c20-4b6b-b07a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:27.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:27Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37fb-3c20-4b6b-b07a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37fb-3c20-4b6b-b07a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/609b95302854274c8116fca0ebcb0bbd029afbc77329a96d9037158b5ba6dc3c/analysis/1432207906/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fb-df90-455f-943b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:27.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8caf4a2e3b249fa62bedbdb53685432b672976d3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9939ff5a2fa3bee2f02c48e8225b9474f4d0208590fdbc7830154a4b38429440']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fc-4fd0-4ea4-be7a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:28.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8caf4a2e3b249fa62bedbdb53685432b672976d3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6591de635f09d739b4b0f8cbcbfc31e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:28Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37fc-e320-415a-8f4d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:28.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:28Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37fc-e320-415a-8f4d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37fc-e320-415a-8f4d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9939ff5a2fa3bee2f02c48e8225b9474f4d0208590fdbc7830154a4b38429440/analysis/1443334128/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fd-a2b0-4591-8217-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:29.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8bdcac846cac11f40b1e5a5924baad07381f2057",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '45abcedc90b310b1f52baae3f504bd34c6c226a612c8d8309083dc4a8b10c9a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fd-f24c-4868-9f4a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:29.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 8bdcac846cac11f40b1e5a5924baad07381f2057",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bb6cf9f84933839e963f6ad249fa6d01']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:29Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37fd-1d24-4af8-be3c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:29.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:29.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:29Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37fd-1d24-4af8-be3c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37fd-1d24-4af8-be3c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/45abcedc90b310b1f52baae3f504bd34c6c226a612c8d8309083dc4a8b10c9a8/analysis/1436857562/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fe-a438-4997-a4c6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:30.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6feee7a522f271aa8340c4a262d6dc342ea96268",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ba3a28dc3285db493b2229196d2d2e2bbd0486e62abee1c65ebb2f9febedcfe3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37fe-2d8c-4c9c-acdd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:30.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6feee7a522f271aa8340c4a262d6dc342ea96268",
|
||
|
|
"pattern": "[file:hashes.MD5 = '665b6cb31d962aefa3037b5849889e06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37fe-1d4c-46e8-bed3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:30.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:30.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:30Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:30Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37fe-1d4c-46e8-bed3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37fe-1d4c-46e8-bed3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ba3a28dc3285db493b2229196d2d2e2bbd0486e62abee1c65ebb2f9febedcfe3/analysis/1443093317/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ff-7774-48ec-bd31-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:31.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6c71a3dfa10ea9f815b7a8de3648fa04cca6d86d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2a4d5ea610fa35581a4aa883445e23ee30c0a2d4796d3962ca2a4b2da3852636']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a37ff-fe28-4087-8296-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:31.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6c71a3dfa10ea9f815b7a8de3648fa04cca6d86d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8a6b50db4af10372905ce6ce7ca54ffc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a37ff-e2b8-4ddb-9896-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:31.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:31.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:31Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a37ff-e2b8-4ddb-9896-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a37ff-e2b8-4ddb-9896-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2a4d5ea610fa35581a4aa883445e23ee30c0a2d4796d3962ca2a4b2da3852636/analysis/1443085513/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3800-f0b0-48fd-84a3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:32.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6997dea208c1a9190073e8567e82b282a512298e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3c7a079d27eb22d8d73c8005a24cfa195daa0220a41fec38b7bab41e78b090d8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3800-4eb0-487d-a1e8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:32.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6997dea208c1a9190073e8567e82b282a512298e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '470d7ec5df848bd0f061362ad30235fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3800-7e2c-49f3-bbd9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:32.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:32.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:32Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3800-7e2c-49f3-bbd9-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3800-7e2c-49f3-bbd9-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3c7a079d27eb22d8d73c8005a24cfa195daa0220a41fec38b7bab41e78b090d8/analysis/1430932428/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3801-014c-421f-95e7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:33.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 678e1ff40c338e7f32d382f414fdd50c5c32df84",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a431cb34a69d132f25d30b8e1a161cefeb5ce7a00d7f23d69521743f0f8b7401']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3801-8d88-4f63-aada-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:33.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 678e1ff40c338e7f32d382f414fdd50c5c32df84",
|
||
|
|
"pattern": "[file:hashes.MD5 = '84a9f53751bc9e03b40354e60296c887']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3801-123c-4461-8ee7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:33.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:33.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:33Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3801-123c-4461-8ee7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3801-123c-4461-8ee7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a431cb34a69d132f25d30b8e1a161cefeb5ce7a00d7f23d69521743f0f8b7401/analysis/1442468885/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3802-183c-4851-834c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:34.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 636ef7c0e29fa985fa1b2a66488e6ef92bbc5fee",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '9c2305d80079c3b4e6239b7014a8aff74e6ccbb9b1170af218c7c31ce642622f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3802-362c-4def-9dca-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:34.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 636ef7c0e29fa985fa1b2a66488e6ef92bbc5fee",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd03334dde5ba41793eefa3741bae5f58']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3802-7438-4c03-adfc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:34.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:34.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:34Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3802-7438-4c03-adfc-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3802-7438-4c03-adfc-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/9c2305d80079c3b4e6239b7014a8aff74e6ccbb9b1170af218c7c31ce642622f/analysis/1425569007/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3803-e34c-447d-949f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:35.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6155de110f0d95255cb6fa0bd448fecd4174fed9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '96d9ce6601f17bb9ef6431bc2546c0e2d5bf4b14351a6ff9937da2c47d21fd7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3803-0518-4660-b992-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:35.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 6155de110f0d95255cb6fa0bd448fecd4174fed9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '82ceeadcbe9a899bb230410083e36e73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3803-9e4c-4121-81e8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:35.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:35.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:35Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3803-9e4c-4121-81e8-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3803-9e4c-4121-81e8-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/96d9ce6601f17bb9ef6431bc2546c0e2d5bf4b14351a6ff9937da2c47d21fd7b/analysis/1421318639/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3804-244c-4380-99d7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:36.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5ffa9b2d3358970af8c1681461f4c8fb20b99beb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3f16bf0e4849085ac4dfa004bdedb153c897480b3189ae3cdab17ffc48a7de07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3804-1a64-472f-8a7f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:36.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:36.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5ffa9b2d3358970af8c1681461f4c8fb20b99beb",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'bfeb4b6a6699e173209d68ef9ded6739']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3805-c768-4c66-8364-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:37.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:37Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:37Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3805-c768-4c66-8364-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3805-c768-4c66-8364-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3f16bf0e4849085ac4dfa004bdedb153c897480b3189ae3cdab17ffc48a7de07/analysis/1443079611/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3805-ac38-45d1-99ac-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:37.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5e2218526b229ab652e0d52bc6c896fa0c7a9e37",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '68980be4fe0627bac585cb98ae130fe3a8f96b1d19babaf3eb528cb4005af3eb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3805-8030-4ab2-9926-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:37.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:37.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5e2218526b229ab652e0d52bc6c896fa0c7a9e37",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cd490dcc691c2f4d82742adcd249ef75']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:37Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3806-ac8c-40f5-856a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:38.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:38Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:38Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3806-ac8c-40f5-856a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3806-ac8c-40f5-856a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/68980be4fe0627bac585cb98ae130fe3a8f96b1d19babaf3eb528cb4005af3eb/analysis/1430932410/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3806-d234-4950-ae68-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:38.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5ddbb11479191be6559ec59809500bb0f8574689",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '152a42e8c6b7f9f73cb8f6705d280ef4d4e9d6063abca2d8a27e97137026e8a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3806-11bc-4b1d-a14f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:38.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:38.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 5ddbb11479191be6559ec59809500bb0f8574689",
|
||
|
|
"pattern": "[file:hashes.MD5 = '15b71cdb932feb80e90d372603c6af14']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3807-1a28-4b90-85f6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:39.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:39Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:39Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3807-1a28-4b90-85f6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3807-1a28-4b90-85f6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/152a42e8c6b7f9f73cb8f6705d280ef4d4e9d6063abca2d8a27e97137026e8a0/analysis/1435326666/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3807-8d84-4249-8032-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:39.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 56dc3dab580585cac6d1d9efc9d946150c41d5e3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3437058bde9ee8aacb6ce5323f5124e0080faeb7bc1c901755efb8e30ebf76ef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3807-d4dc-4154-990d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:39.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:39.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 56dc3dab580585cac6d1d9efc9d946150c41d5e3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '17984eb3926bf99f0ccb367f4fba12e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3808-7b48-44e5-9b41-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:40.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:40Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3808-7b48-44e5-9b41-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3808-7b48-44e5-9b41-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3437058bde9ee8aacb6ce5323f5124e0080faeb7bc1c901755efb8e30ebf76ef/analysis/1425012774/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3808-9f80-47f3-a4f6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:40.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 4a131d65a1c780447606faa509f1ed2ec08771b6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74918814b70b669b7be855571a7706740fc57ae7e82b87b3d80f12d7feeb81e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3808-26bc-40d2-a164-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:40.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:40.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 4a131d65a1c780447606faa509f1ed2ec08771b6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4326378f2ae7fed032eaf307715b7a4c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3809-428c-49ac-8a4a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:41.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:41Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3809-428c-49ac-8a4a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3809-428c-49ac-8a4a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/74918814b70b669b7be855571a7706740fc57ae7e82b87b3d80f12d7feeb81e5/analysis/1442732798/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3809-2fec-40b1-96c6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:41.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 452f039f5d26e047900e8af8b81bb986bea21623",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2e03c737ae3541998a186f8957680959a25bdab4f381ce64809e97bb534447a8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3809-9018-4ee0-8ee3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:41.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:41.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 452f039f5d26e047900e8af8b81bb986bea21623",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dcdda548121515b994a241d5071f19d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:41Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380a-3318-4181-a19a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:42.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:42Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380a-3318-4181-a19a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380a-3318-4181-a19a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2e03c737ae3541998a186f8957680959a25bdab4f381ce64809e97bb534447a8/analysis/1430932408/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380a-a870-44a1-a86e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:42.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 3f3a2f8340ef11afcbdda834af2aa8e3a64e94b9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6db53ff6730a45138b040d4ba8b01f33117780c02d7bd8373505d7c5870b6d23']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380a-3300-4186-93ba-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:42.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:42.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 3f3a2f8340ef11afcbdda834af2aa8e3a64e94b9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1f80a57a3b99eeb8016339991a27593f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380b-60f8-4159-af62-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:43.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:43Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:43Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380b-60f8-4159-af62-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380b-60f8-4159-af62-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/6db53ff6730a45138b040d4ba8b01f33117780c02d7bd8373505d7c5870b6d23/analysis/1425560530/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380b-04b0-41cf-89ac-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:43.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 3d108765da9e451c3800524d0a524ac210c89953",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '55360a5553c988dc0e0db1071b45b8bb997b7dddab3f2266538ce7df2d691e57']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380b-c58c-4f49-94af-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:43.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:43.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 3d108765da9e451c3800524d0a524ac210c89953",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0cdacfaac968acf02083fbc03e0714fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380c-f6b4-4a0b-9973-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:44.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:44Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380c-f6b4-4a0b-9973-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380c-f6b4-4a0b-9973-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/55360a5553c988dc0e0db1071b45b8bb997b7dddab3f2266538ce7df2d691e57/analysis/1430932408/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380c-ede8-49b5-af8d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:44.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:44.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 37235cfae855f41be4128b32d6a7e399325664e8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3a18c3238dc296aa246a6576ea41fbec50b0b0d4351e6f9d684ad7756adfb078']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:44Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380d-0f38-44f5-a277-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:45.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 37235cfae855f41be4128b32d6a7e399325664e8",
|
||
|
|
"pattern": "[file:hashes.MD5 = '44f3753669b74dfca2355fd613a383c9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380d-be28-419e-a4ba-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:45.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:45Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:45Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380d-be28-419e-a4ba-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380d-be28-419e-a4ba-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3a18c3238dc296aa246a6576ea41fbec50b0b0d4351e6f9d684ad7756adfb078/analysis/1430932408/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380d-21ec-4ac1-9ef6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:45.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:45.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 33ffaa455e8f68f1be227ed2d32427fc3c35a20e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ad5d2722d5f5d186e976ecfdb8a98d896806c2dc362551a7c358b0b7ffa401e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:45Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380e-e904-49ef-9146-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:46.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 33ffaa455e8f68f1be227ed2d32427fc3c35a20e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ec9da1b47ec5d6b495a43a246e6d8ea3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380e-24a4-4476-bedc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:46.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:46Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:46Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380e-24a4-4476-bedc-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380e-24a4-4476-bedc-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ad5d2722d5f5d186e976ecfdb8a98d896806c2dc362551a7c358b0b7ffa401e5/analysis/1429720738/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380e-c020-42e1-9501-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:46.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:46.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 31e9839b2e3b656406faabb7f05fd76a53edea93",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c1b8700c8f92b9b5f54bd80b33f77bed11a92807b0e740de350df282164478b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380f-06c4-4fd4-92e4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:47.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 31e9839b2e3b656406faabb7f05fd76a53edea93",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c268074b3e1d855e541318a94dd21a76']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a380f-ad18-44bd-9fe7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:47.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:47Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:47Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a380f-ad18-44bd-9fe7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a380f-ad18-44bd-9fe7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c1b8700c8f92b9b5f54bd80b33f77bed11a92807b0e740de350df282164478b2/analysis/1430932424/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a380f-2d10-4c50-9f3f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:47.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:47.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2e52513029f0b164a27ee997d838339e83c74222",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '478f7c353e87d0da031f37b2baeead94632c588493febbeda7d629e0b57b53bd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3810-fbe0-4196-b434-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:48.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2e52513029f0b164a27ee997d838339e83c74222",
|
||
|
|
"pattern": "[file:hashes.MD5 = '94666bca3fe81831a23f60c407840408']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3810-4334-4cdd-9af2-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:48.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:48Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3810-4334-4cdd-9af2-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3810-4334-4cdd-9af2-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/478f7c353e87d0da031f37b2baeead94632c588493febbeda7d629e0b57b53bd/analysis/1425017610/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3810-fc64-4a80-aab8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:48.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:48.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2a6067bfc5eefe252af572a516e52cf40c8cf3c5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '604946a62b8369de3249689e4b62dda987bd97ba0d7cddb297d8e48be3a187a5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:48Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3811-7200-4be4-9dbf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:49.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2a6067bfc5eefe252af572a516e52cf40c8cf3c5",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ba5086397b7e59647c092173df235c97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3811-4a34-4c92-bf38-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:49.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:49Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:49Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3811-4a34-4c92-bf38-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3811-4a34-4c92-bf38-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/604946a62b8369de3249689e4b62dda987bd97ba0d7cddb297d8e48be3a187a5/analysis/1430932424/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3811-b3e8-4947-a5a6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:49.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:49.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 28e403d40f9f6ef209d983c9bf12c2375e07efe6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2d01eb841bf3da99bb988226ca32bf508446572fdd3bb30fa39fa1a74fbc0cd3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3812-7f3c-41c4-b6d3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:50.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 28e403d40f9f6ef209d983c9bf12c2375e07efe6",
|
||
|
|
"pattern": "[file:hashes.MD5 = '267229ac3f10f55ce6fe7862b6694995']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3812-fee8-409c-b074-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:50.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:50Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:50Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3812-fee8-409c-b074-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3812-fee8-409c-b074-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2d01eb841bf3da99bb988226ca32bf508446572fdd3bb30fa39fa1a74fbc0cd3/analysis/1430932405/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3812-efcc-4bbb-8c5a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:50.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:50.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 25f3ad83db42bfba5704afab906697022f004a2e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7116c1855395181998592a12c42edfa85e91d8774aecbc413ff470fc732d3213']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3813-888c-4b1f-851e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:51.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 25f3ad83db42bfba5704afab906697022f004a2e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd54efb881bbb989a6f58c0f304da603e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3813-f354-4ecd-aa07-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:51.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:51Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:51Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3813-f354-4ecd-aa07-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3813-f354-4ecd-aa07-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7116c1855395181998592a12c42edfa85e91d8774aecbc413ff470fc732d3213/analysis/1430932423/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3813-44d8-4b3e-bfd7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:51.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:51.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2577ae447809052b671e065472d8f3a92ff4432b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a481301fdf5948c4eb8d8fc30d60cc998943aa31249379b792f1b00683d106fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3814-90e0-4fe0-8721-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:52.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 2577ae447809052b671e065472d8f3a92ff4432b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'afcb1ca2746a7deab653327b81f33d3b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3814-5788-426d-9d61-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:52.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:52Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3814-5788-426d-9d61-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3814-5788-426d-9d61-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a481301fdf5948c4eb8d8fc30d60cc998943aa31249379b792f1b00683d106fc/analysis/1418308607/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3815-ae4c-4e8c-acfc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:52.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:52.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 236bdc316797309b21b466dac2cafb1685b5424a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '537b9cc20aca45043ff38f599830af90a256597b04481547c689e3f4204a1ad8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3815-4150-484b-be14-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:53.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 236bdc316797309b21b466dac2cafb1685b5424a",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd3a35614475128b473e20a21d3c0cb07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3815-9df8-4e40-8a9e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:53.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:53.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:53Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:53Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3815-9df8-4e40-8a9e-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3815-9df8-4e40-8a9e-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/537b9cc20aca45043ff38f599830af90a256597b04481547c689e3f4204a1ad8/analysis/1430932406/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3816-4508-40d8-8ecf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:54.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 20dcea80d03449c7c573efe583cb2ec11962452e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '217559fa04ac6e55b3a91b5750fd49856e712a56e5d45c6fa19f36df546ae765']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3816-092c-4fce-a85e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:54.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 20dcea80d03449c7c573efe583cb2ec11962452e",
|
||
|
|
"pattern": "[file:hashes.MD5 = '662ebfa5e7f5f46a0ab2b4d71eab82a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3816-da5c-489c-a884-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:54.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:54.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:54Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3816-da5c-489c-a884-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3816-da5c-489c-a884-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/217559fa04ac6e55b3a91b5750fd49856e712a56e5d45c6fa19f36df546ae765/analysis/1433402668/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3817-6290-4236-9791-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:55.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 192c420744f4fd2fb0d1049669f49a52de5b488b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '50e2886c6bd650711542c631b7a9a17d6e1ce683ef3a4c6bc1d1a1f546407460']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3817-ee14-436e-a431-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:55.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 192c420744f4fd2fb0d1049669f49a52de5b488b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2c395f211db2d02cb544448729d0f081']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3817-8910-4955-b3ab-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:55.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:55.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:55Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3817-8910-4955-b3ab-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3817-8910-4955-b3ab-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/50e2886c6bd650711542c631b7a9a17d6e1ce683ef3a4c6bc1d1a1f546407460/analysis/1442486925/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3818-ed70-435a-b376-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:56.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 093526b670953023701fbc59973673427dabae7b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '81a9bd16a53a62878b6223b5a7314da6a8aa6a4e24008872e1368a1caf54974e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3818-a2f4-4efc-9a8c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:56.000Z",
|
||
|
|
"description": "Carberp - Xchecked via VT: 093526b670953023701fbc59973673427dabae7b",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'db83e301564ff613dd1ca23c30a387f0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3818-8be8-4a89-ad0b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:56.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:56.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:56Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3818-8be8-4a89-ad0b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3818-8be8-4a89-ad0b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/81a9bd16a53a62878b6223b5a7314da6a8aa6a4e24008872e1368a1caf54974e/analysis/1442486935/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3819-fe54-4b28-9ab0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:57.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: cac0b41ef7eedcd3a8a5f83f7424c426ca05925c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ff5f695944b1b743c88745d642b04f04dd47bfd19e1c496024f5439f9d0cc87a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3819-6e84-425d-88a6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:57.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: cac0b41ef7eedcd3a8a5f83f7424c426ca05925c",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1b8b3657bcebd8ed094b6e8e943cc458']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3819-2e54-4e24-b79c-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:57.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:57.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:57Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3819-2e54-4e24-b79c-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3819-2e54-4e24-b79c-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ff5f695944b1b743c88745d642b04f04dd47bfd19e1c496024f5439f9d0cc87a/analysis/1437686146/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381a-add8-45f7-9a23-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:58.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: b10405a175b3d5df8810092ab0fec8a6677449f9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '209b2f58e8928f9eb796bed63dedb1e08eca2efdffc98f6ae2c0ab7b5c0f5ff5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381a-5ac8-4fd3-8695-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:58.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: b10405a175b3d5df8810092ab0fec8a6677449f9",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e73c900258369f930367b38c74ea386c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a381a-a594-4181-afa9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:58.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:58.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:58Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a381a-a594-4181-afa9-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a381a-a594-4181-afa9-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/209b2f58e8928f9eb796bed63dedb1e08eca2efdffc98f6ae2c0ab7b5c0f5ff5/analysis/1430932416/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381b-63dc-456e-9261-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:59.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: b00650953c80493ff396ce0b20c59929b898e941",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381b-3f60-4f52-87bb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:59.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: b00650953c80493ff396ce0b20c59929b898e941",
|
||
|
|
"pattern": "[file:hashes.MD5 = '9eb2158d227eff7fc4a332bb82f0cd90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:04:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a381b-5e58-4c0a-93bd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:04:59.000Z",
|
||
|
|
"modified": "2015-09-29T07:04:59.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:04:59Z",
|
||
|
|
"last_observed": "2015-09-29T07:04:59Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a381b-5e58-4c0a-93bd-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a381b-5e58-4c0a-93bd-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8702469e99e76ebfb73f28848cc10ca8fd9c8dabeedb9559a9bb4239dfba0941/analysis/1430932415/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381c-77b4-48cb-9f80-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:00.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ad59434e21392a8395924c7919f6d553cddde91d",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '2ecb33f974352fd464b09bbb5d5875897c05d05b6eeba1adac46a08a1c9ffe59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381c-8824-4d74-a83e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:00.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:00.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ad59434e21392a8395924c7919f6d553cddde91d",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4adae24a22468b1516afc7e5f0f9e893']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:00Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a381d-8eec-4645-a5fa-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:01.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:01Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:01Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a381d-8eec-4645-a5fa-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a381d-8eec-4645-a5fa-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/2ecb33f974352fd464b09bbb5d5875897c05d05b6eeba1adac46a08a1c9ffe59/analysis/1434621052/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381d-6598-455f-9924-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:01.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ac6d6a5428b08f307cc4c9a52f73ac78d62bc6fb",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b2db2fdfc7b8574ec8b4a758ce56f54c6ec9e80bcfa1b43e50396f3fb0a9555a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381d-eedc-4b1f-b724-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:01.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:01.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ac6d6a5428b08f307cc4c9a52f73ac78d62bc6fb",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3179f28c3d8d004bee2a7d03dc4e268a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a381e-5094-4198-9626-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:02.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:02Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a381e-5094-4198-9626-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a381e-5094-4198-9626-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/b2db2fdfc7b8574ec8b4a758ce56f54c6ec9e80bcfa1b43e50396f3fb0a9555a/analysis/1434619967/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381e-24fc-45d8-8fa9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:02.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ab91979cf657b563acf9e3576f2b0ec49f57f461",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a0924f44f4caf759445829a78ec318b1556a09d641c6745c74c170884d8f1ef3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381e-2670-4944-9f20-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:02.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:02.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: ab91979cf657b563acf9e3576f2b0ec49f57f461",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c755656471437f1285b351472ac3d6db']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a381f-11ec-4296-bad6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:03.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:03Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:03Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a381f-11ec-4296-bad6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a381f-11ec-4296-bad6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a0924f44f4caf759445829a78ec318b1556a09d641c6745c74c170884d8f1ef3/analysis/1430932434/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381f-354c-490c-a3cd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:03.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 88f5100e446e354201de406730606c865062bd4a",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cdf6a003a504cd8e3e21e4a798468ea5aa031f73d34a89a1139a01ecfd823ed0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a381f-3bcc-4d95-87cc-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:03.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:03.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 88f5100e446e354201de406730606c865062bd4a",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4bebe56c03400e89f4d8b88a6e48d12a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3820-63d4-4104-89b1-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:04.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:04Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3820-63d4-4104-89b1-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3820-63d4-4104-89b1-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/cdf6a003a504cd8e3e21e4a798468ea5aa031f73d34a89a1139a01ecfd823ed0/analysis/1443332199/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3820-0744-4d05-88dd-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:04.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 87c2f36393e5232d4a23b555cb233cb81456f4ca",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4af9d008f6ef145d1a8feae0695874abad9fc547eb2e78c2c31d2d14e68a46dc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3820-d6d4-4629-b909-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:04.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:04.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 87c2f36393e5232d4a23b555cb233cb81456f4ca",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2502ba4b6aaf9d40d7a709f36a6e1d2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3821-0f0c-42e0-9678-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:05.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:05Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3821-0f0c-42e0-9678-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3821-0f0c-42e0-9678-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/4af9d008f6ef145d1a8feae0695874abad9fc547eb2e78c2c31d2d14e68a46dc/analysis/1443331112/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3821-50cc-4ec1-9e62-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:05.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 87495985394dc1effc83cf56bdbb8413971fcdd7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '74adf37b9abdfb19fcba28b7f7c7ab35f4be340ea2378d95dcc5a2c7cd032e6f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3821-4c1c-4cda-b3be-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:05.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:05.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 87495985394dc1effc83cf56bdbb8413971fcdd7",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b9171bf256c616add9b4823c2c068774']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3822-db28-4d07-924b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:06.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:06Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3822-db28-4d07-924b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3822-db28-4d07-924b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/74adf37b9abdfb19fcba28b7f7c7ab35f4be340ea2378d95dcc5a2c7cd032e6f/analysis/1430932430/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3822-f850-4097-9430-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:06.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 7dbf34472139d7d4ed21395fcf16d8894254705e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'ec9a24edfe708d946338e797753fff576ed1753264695282e9604179e8931daf']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3822-6030-47ef-a35a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:06.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:06.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 7dbf34472139d7d4ed21395fcf16d8894254705e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e866b54298af571291ed65303e2bcad4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3823-725c-488e-9ac3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:07.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:07Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3823-725c-488e-9ac3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3823-725c-488e-9ac3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/ec9a24edfe708d946338e797753fff576ed1753264695282e9604179e8931daf/analysis/1418373209/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3823-66b8-47e0-a552-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:07.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 79f0612468d8ac28d1ab2792ba9861f2fb6be548",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c11e8e1c310ef749f699aa7fa2cb3faf8fa30fd2fc24107ca6a53001473618b6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3823-8934-48f9-a298-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:07.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:07.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 79f0612468d8ac28d1ab2792ba9861f2fb6be548",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1068b204e6f31e1825dab243849e5ac2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3824-1140-4c7a-b106-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:08.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:08Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3824-1140-4c7a-b106-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3824-1140-4c7a-b106-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c11e8e1c310ef749f699aa7fa2cb3faf8fa30fd2fc24107ca6a53001473618b6/analysis/1443099206/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3824-7154-4bad-9f0b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:08.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:08.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 783149a773f0aee05474c0f56c778f64133acbb3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '30b6416413a9d40847d2d782e7b0be44893bd2ac19a56587ec229615d66d7e03']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3825-3978-42d1-80ef-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:09.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 783149a773f0aee05474c0f56c778f64133acbb3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '27b4b546f0c5e18dc0427901d204c91e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3825-0550-4f87-a909-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:09.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:09Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3825-0550-4f87-a909-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3825-0550-4f87-a909-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/30b6416413a9d40847d2d782e7b0be44893bd2ac19a56587ec229615d66d7e03/analysis/1430932430/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3825-4120-434a-9399-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:09.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:09.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 77ba6ecb3b6a3ff17915a1d4f14ab8d2d3d027d6",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '032cd086a27ba1898ce655bc1f49e8fe73231a43a5e8d1ea4032db863eebd2b9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3826-abc0-4544-b21b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:10.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 77ba6ecb3b6a3ff17915a1d4f14ab8d2d3d027d6",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ac41460210c4829d0edfd67bf64a2a37']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3826-4434-4a67-928d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:10.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:10Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3826-4434-4a67-928d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3826-4434-4a67-928d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/032cd086a27ba1898ce655bc1f49e8fe73231a43a5e8d1ea4032db863eebd2b9/analysis/1415592667/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3826-f04c-4411-8298-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:10.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:10.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 768eb6f4a75ba132d42ee4ed0a74eb5beb23d9f8",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c8f55b190258076278d606ad39d1b728664e4510e3743095f17487fd82e7298c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3827-984c-408e-a175-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:11.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 768eb6f4a75ba132d42ee4ed0a74eb5beb23d9f8",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7ed4ed7e7d69d55577319d50224300a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3827-2500-4c0d-b367-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:11.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:11Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3827-2500-4c0d-b367-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3827-2500-4c0d-b367-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/c8f55b190258076278d606ad39d1b728664e4510e3743095f17487fd82e7298c/analysis/1430932428/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3827-a268-4356-bc3b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:11.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:11.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 733a2ea1e8f4ece7144679b219c510de1c02542e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '12bd934d9b3bb7b84b63d897157aaf46460389e69f370df9d6b879ed50681e7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3828-7f88-409f-9920-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:12.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 733a2ea1e8f4ece7144679b219c510de1c02542e",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e879580895a50d04b7401e834332534b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3828-adb0-42db-82e7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:12.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:12Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3828-adb0-42db-82e7-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3828-adb0-42db-82e7-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/12bd934d9b3bb7b84b63d897157aaf46460389e69f370df9d6b879ed50681e7e/analysis/1436424222/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3828-fa2c-451c-b6d4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:12.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:12.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 64b79c92388244a8145bb786ba5f6b7d168fe620",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3163bee22a087279fe9b53bd1b74651ec3a1c1508f7cee137e6f9992cdcb683f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3829-3ba8-4fe2-a71e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:13.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 64b79c92388244a8145bb786ba5f6b7d168fe620",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2dd786157bc8a6618bad11cb50e46ec4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3829-4f44-4603-8ab9-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:13.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:13Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3829-4f44-4603-8ab9-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3829-4f44-4603-8ab9-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/3163bee22a087279fe9b53bd1b74651ec3a1c1508f7cee137e6f9992cdcb683f/analysis/1433946306/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3829-844c-4810-80cf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:13.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:13.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 403ec3cc696cc02d4cd3e4b41486228fc4537053",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '09a0de24048545c0a09efc381a0565304c62bd94c720ee0fb6dcd650aad71fbc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382a-a3e0-4a7b-b564-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:14.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 403ec3cc696cc02d4cd3e4b41486228fc4537053",
|
||
|
|
"pattern": "[file:hashes.MD5 = '892ea28f63eb6803618f61885ec7a83e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382a-3888-4c7b-b7b3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:14.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:14Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382a-3888-4c7b-b7b3-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382a-3888-4c7b-b7b3-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/09a0de24048545c0a09efc381a0565304c62bd94c720ee0fb6dcd650aad71fbc/analysis/1408621518/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382a-4d9c-4a4e-b70f-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:14.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:14.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 06fb8253707bfb7407b24329bb1f0bccf1c75f61",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fc867273ae8aab107c98309d505e11f9c2804073469b21ebc54d6b78c1176bc2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382b-05a0-4802-894b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:15.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 06fb8253707bfb7407b24329bb1f0bccf1c75f61",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7e90ded8507444dc8b2d68309c1600c7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382b-d390-4e71-a061-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:15.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:15Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382b-d390-4e71-a061-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382b-d390-4e71-a061-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/fc867273ae8aab107c98309d505e11f9c2804073469b21ebc54d6b78c1176bc2/analysis/1425568283/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382b-cf40-478f-b0cf-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:15.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:15.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 0164f765fb7052a8d424f00b171ed07d12ad38c3",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '7594f9c15ded6d4c3046348cf408d06187417776046138f6e6b488ca9c8a1115']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382c-92d8-46e8-85e7-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:16.000Z",
|
||
|
|
"description": "Buhtrap - Xchecked via VT: 0164f765fb7052a8d424f00b171ed07d12ad38c3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '83c6a3f15fb4a930a5565a83471a16f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382c-8008-4f5f-849d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:16.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:16.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:16Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382c-8008-4f5f-849d-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382c-8008-4f5f-849d-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/7594f9c15ded6d4c3046348cf408d06187417776046138f6e6b488ca9c8a1115/analysis/1430932421/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382d-348c-44f3-aafa-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:17.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: d001eda06ebc8e1be0c370efa22127070068b0a0",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '739557f1737c035a7c8934330526f526f3af1f31a5d1f92cce73f79154eceff6']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382d-bc34-4222-bf15-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:17.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: d001eda06ebc8e1be0c370efa22127070068b0a0",
|
||
|
|
"pattern": "[file:hashes.MD5 = '597b6938c7ee7e2e6e16b20a2125e53b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382d-61ec-488d-9e0e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:17.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:17.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:17Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382d-61ec-488d-9e0e-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382d-61ec-488d-9e0e-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/739557f1737c035a7c8934330526f526f3af1f31a5d1f92cce73f79154eceff6/analysis/1441217001/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382e-93dc-4fa1-9640-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:18.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: 9510dea35642c327533041a29a3e773c8e3be718",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'bfe4247cf45a1b05d25ecf91e1a9695c2dd8cdbcdd1b8e990a1b310b2c8bf0b0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382e-e8a0-4087-b12d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:18.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: 9510dea35642c327533041a29a3e773c8e3be718",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aa9d900fe97322737068b38285ab9b1e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:18Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382e-f660-49c9-9cce-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:18.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:18.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:18Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:18Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382e-f660-49c9-9cce-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382e-f660-49c9-9cce-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/bfe4247cf45a1b05d25ecf91e1a9695c2dd8cdbcdd1b8e990a1b310b2c8bf0b0/analysis/1443338334/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382f-5b50-472a-9e05-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:19.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: 22c3a093a23ee698adeaae811028be560acf734c",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '1d425e93d127e4de0f0c9dc20060fb2fbb0d218efdf3c431d186c9910c69ea22']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a382f-c9f8-4ffb-9a5e-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:19.000Z",
|
||
|
|
"description": "Bandok - Xchecked via VT: 22c3a093a23ee698adeaae811028be560acf734c",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f4738fefe6d0eacfbfebcb533d29cb0f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:19Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a382f-d2e4-4f7d-8ed5-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:19.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:19.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:19Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:19Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a382f-d2e4-4f7d-8ed5-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a382f-d2e4-4f7d-8ed5-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/1d425e93d127e4de0f0c9dc20060fb2fbb0d218efdf3c431d186c9910c69ea22/analysis/1438150067/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3830-b6d0-4ec5-96eb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:20.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fcabc3269537e4111fa65d35359fa797d5c65778",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '163277c32a801819fdadcb8ec277f20fd3ecc01e3eeca36df8dbd7e7c51b1c7a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3830-52a4-441a-977a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:20.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fcabc3269537e4111fa65d35359fa797d5c65778",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c0f7fd333131ceca4292419e207f83fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:20Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3830-40f8-4372-9e8a-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:20.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:20.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:20Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:20Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3830-40f8-4372-9e8a-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3830-40f8-4372-9e8a-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/163277c32a801819fdadcb8ec277f20fd3ecc01e3eeca36df8dbd7e7c51b1c7a/analysis/1437566207/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3831-12ec-4d41-9370-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:21.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fa9669f1b70e15decaaf36cf2a35cf3ca7a599d9",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '5d625d49ed73f5678246b18accd2bab92938be0b3e8771553365dc50f4219bfe']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3831-efa8-48b0-adb8-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:21.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fa9669f1b70e15decaaf36cf2a35cf3ca7a599d9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4719209982b272a06ac511119b9aa958']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:21Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3831-72f4-487a-9a4b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:21.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:21.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:21Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:21Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3831-72f4-487a-9a4b-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3831-72f4-487a-9a4b-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/5d625d49ed73f5678246b18accd2bab92938be0b3e8771553365dc50f4219bfe/analysis/1436858143/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3832-524c-4a13-82a0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:22.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fa8ce4947cb443777fa3567232227f19358b2e30",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '586dff129e35db080ed1f4c2fb672350776a1437a71ff72c7dcafb2550acec7c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3832-82c4-4650-917d-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:22.000Z",
|
||
|
|
"description": "Badur - Xchecked via VT: fa8ce4947cb443777fa3567232227f19358b2e30",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e4265571e448e163b7832d55292a4ce9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:22Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3832-ae98-4acf-a0f4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:22.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:22.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:22Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:22Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3832-ae98-4acf-a0f4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3832-ae98-4acf-a0f4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/586dff129e35db080ed1f4c2fb672350776a1437a71ff72c7dcafb2550acec7c/analysis/1430932443/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3833-b7c8-4bc1-be87-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:23.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: ff6561bebc8b49c342f76153cb6fd2d9d0574a42",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8891c359e0ad2466255936dce481174aa7a67e560cc025d008e6f164796a4a5d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3833-74b4-41fe-b8a3-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:23.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: ff6561bebc8b49c342f76153cb6fd2d9d0574a42",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4067753a5d925d9b56c850f479d39850']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3833-7b88-473b-b7d4-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:23.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:23.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:23Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:23Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3833-7b88-473b-b7d4-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3833-7b88-473b-b7d4-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/8891c359e0ad2466255936dce481174aa7a67e560cc025d008e6f164796a4a5d/analysis/1440235492/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3834-3130-427b-8d68-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:24.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: fac76e87d63d8d9c1d322d110897761ad1c7f935",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e24e1358770ec4286722a9a57efd3cff96651542ff6594da8f1a8cd8d96272a0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3834-a948-493b-ba51-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:24.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: fac76e87d63d8d9c1d322d110897761ad1c7f935",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f56daeb21e1ff5a779d7291bdd8b84e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:24Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3835-8f38-4458-9913-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:24.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:24.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:24Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:24Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3835-8f38-4458-9913-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3835-8f38-4458-9913-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e24e1358770ec4286722a9a57efd3cff96651542ff6594da8f1a8cd8d96272a0/analysis/1441216652/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3835-5794-4492-966b-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:25.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: 88e4462b78bd6a5030fd16b80cbd30446e9c9346",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a857c301c8a1332bf04c6c2168daa62afdaedf227fabb4e79568163d7648b2bb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3835-9470-4e49-bbda-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:25.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:25.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: 88e4462b78bd6a5030fd16b80cbd30446e9c9346",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3eb2c88acd0f4aba8e4e5867efd74e73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3836-8994-4432-bec0-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:26.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:26Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:26Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3836-8994-4432-bec0-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3836-8994-4432-bec0-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/a857c301c8a1332bf04c6c2168daa62afdaedf227fabb4e79568163d7648b2bb/analysis/1443331894/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3836-8864-4b06-bb63-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:26.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: 6a900d595fa115bc6808891b83043b3b73a8b56b",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'e78ffa97fb18de7bbf3f706287aea423ade5842d4cf83e025fb8722a7134fe54']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3836-dcc4-427c-9254-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:26.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:26.000Z",
|
||
|
|
"description": "Andromeda - Xchecked via VT: 6a900d595fa115bc6808891b83043b3b73a8b56b",
|
||
|
|
"pattern": "[file:hashes.MD5 = '73814a38215470a005cb375114f3d3f3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3837-f878-4f75-80e6-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:27.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:27Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:27Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3837-f878-4f75-80e6-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3837-f878-4f75-80e6-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/e78ffa97fb18de7bbf3f706287aea423ade5842d4cf83e025fb8722a7134fe54/analysis/1436420726/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3837-4740-4d71-9086-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:27.000Z",
|
||
|
|
"description": "Ammyy - Xchecked via VT: 07ac3100117511990ce5289f34516bfde0cf8955",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '98d912ac381b0b812cd8c853fab21f5f1d4bc25cbd2c68a6be6eedf7a12123aa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--560a3837-beec-456a-90be-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:27.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:27.000Z",
|
||
|
|
"description": "Ammyy - Xchecked via VT: 07ac3100117511990ce5289f34516bfde0cf8955",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c554f2f4d1b69297f6b2411cbba2de7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2015-09-29T07:05:27Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--560a3838-3190-4d2d-85eb-e475950d210b",
|
||
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
||
|
|
"created": "2015-09-29T07:05:28.000Z",
|
||
|
|
"modified": "2015-09-29T07:05:28.000Z",
|
||
|
|
"first_observed": "2015-09-29T07:05:28Z",
|
||
|
|
"last_observed": "2015-09-29T07:05:28Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--560a3838-3190-4d2d-85eb-e475950d210b"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--560a3838-3190-4d2d-85eb-e475950d210b",
|
||
|
|
"value": "https://www.virustotal.com/file/98d912ac381b0b812cd8c853fab21f5f1d4bc25cbd2c68a6be6eedf7a12123aa/analysis/1435212523/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|