885 lines
38 KiB
JSON
885 lines
38 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--56e177ef-38cc-441b-a398-4f66950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:30.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:30.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--56e177ef-38cc-441b-a398-4f66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:30.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:30.000Z",
|
||
|
|
"name": "OSINT - Shifting Tactics: Tracking changes in years-long espionage campaign against Tibetans",
|
||
|
|
"published": "2016-03-10T14:12:32Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--56e1780d-270c-4cc7-ac76-4a92950d210f",
|
||
|
|
"url--56e1780d-270c-4cc7-ac76-4a92950d210f",
|
||
|
|
"x-misp-attribute--56e1781e-46c4-4d39-b770-413c950d210f",
|
||
|
|
"indicator--56e17844-e498-42ac-a6ea-4c13950d210f",
|
||
|
|
"indicator--56e17844-a20c-48a2-939f-4f67950d210f",
|
||
|
|
"indicator--56e17844-51dc-4556-a088-46c4950d210f",
|
||
|
|
"indicator--56e17845-d6f0-429c-b890-4079950d210f",
|
||
|
|
"indicator--56e17845-8224-4308-a3a6-4702950d210f",
|
||
|
|
"indicator--56e17845-8ef0-479b-944d-41b3950d210f",
|
||
|
|
"indicator--56e178e3-cf8c-4f0e-8dc4-4fae950d210f",
|
||
|
|
"indicator--56e17a4a-dee8-461f-9d0d-4594950d210f",
|
||
|
|
"indicator--56e17a4a-0678-4fc2-985c-4912950d210f",
|
||
|
|
"indicator--56e17ace-1a58-46e1-ba4a-4f89950d210f",
|
||
|
|
"indicator--56e17ace-007c-4f0d-b564-4166950d210f",
|
||
|
|
"indicator--56e17acf-a6e0-4daf-97e5-422e950d210f",
|
||
|
|
"indicator--56e17b8c-398c-450a-bd76-498b950d210f",
|
||
|
|
"indicator--56e17b8d-449c-446a-bbcb-4d96950d210f",
|
||
|
|
"indicator--56e17c47-9ca0-4037-afb1-4c8d950d210f",
|
||
|
|
"indicator--56e17caa-2740-4d49-8b47-4c56950d210f",
|
||
|
|
"indicator--56e17d3a-44d4-47f9-aa6d-4722950d210f",
|
||
|
|
"indicator--56e17d86-0c10-4c04-b412-4e6a02de0b81",
|
||
|
|
"indicator--56e17d87-9904-442d-bfe2-4dc902de0b81",
|
||
|
|
"observed-data--56e17d87-3b08-44c5-9dfb-486202de0b81",
|
||
|
|
"url--56e17d87-3b08-44c5-9dfb-486202de0b81",
|
||
|
|
"indicator--56e17d87-a608-4e4c-bdb2-443502de0b81",
|
||
|
|
"indicator--56e17d88-deb8-4f0a-a0cd-4f3902de0b81",
|
||
|
|
"observed-data--56e17d88-f460-4120-ad15-4ea802de0b81",
|
||
|
|
"url--56e17d88-f460-4120-ad15-4ea802de0b81",
|
||
|
|
"indicator--56e17d88-9390-4464-b901-466f02de0b81",
|
||
|
|
"indicator--56e17d89-f498-448c-bad0-4d4802de0b81",
|
||
|
|
"observed-data--56e17d89-a69c-40a0-9352-45f002de0b81",
|
||
|
|
"url--56e17d89-a69c-40a0-9352-45f002de0b81",
|
||
|
|
"indicator--56e17d89-4d84-4ac6-80a5-47de02de0b81",
|
||
|
|
"indicator--56e17d8a-0c60-4f56-87bf-448f02de0b81",
|
||
|
|
"observed-data--56e17d8a-d9c0-4638-9158-4de502de0b81",
|
||
|
|
"url--56e17d8a-d9c0-4638-9158-4de502de0b81",
|
||
|
|
"indicator--56e17d8a-4294-4c3e-80c9-48d102de0b81",
|
||
|
|
"indicator--56e17d8a-414c-4f93-8496-40c002de0b81",
|
||
|
|
"observed-data--56e17d8b-231c-4363-8006-4b5202de0b81",
|
||
|
|
"url--56e17d8b-231c-4363-8006-4b5202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e1780d-270c-4cc7-ac76-4a92950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:35:09.000Z",
|
||
|
|
"modified": "2016-03-10T13:35:09.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:35:09Z",
|
||
|
|
"last_observed": "2016-03-10T13:35:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e1780d-270c-4cc7-ac76-4a92950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e1780d-270c-4cc7-ac76-4a92950d210f",
|
||
|
|
"value": "https://citizenlab.org/2016/03/shifting-tactics/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--56e1781e-46c4-4d39-b770-413c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:35:26.000Z",
|
||
|
|
"modified": "2016-03-10T13:35:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "This report describes the latest iteration in a long-running espionage campaign against the Tibetan community. We detail how the attackers continuously adapt their campaigns to their targets, shifting tactics from document-based malware to conventional phishing that draws on \u00e2\u20ac\u0153inside\u00e2\u20ac\u009d knowledge of community activities. This adaptation appears to track changes in security behaviors within the Tibetan community, which has been promoting a move from sharing attachments via e-mail to using cloud-based file sharing alternatives such as Google Drive.\r\n\r\nWe connect the attack group\u00e2\u20ac\u2122s infrastructure and techniques to a group previously identified by Palo Alto Networks, which they named Scarlet Mimic. We provide further context on Scarlet Mimic\u00e2\u20ac\u2122s targeting and tactics, and the intended victims of their attack campaigns. In addition, while Scarlet Mimic may be conducting malware attacks using other infrastructure, we analyze how the attackers re-purposed a cluster of their malware Command and Control (C2) infrastructure to mount the recent phishing campaign.\r\n\r\nThis move is only the latest development in the ongoing cat and mouse game between attack groups like Scarlet Mimic and the Tibetan community. The speed and ease with which attackers continue to adapt highlights the challenges faced by Tibetans who are trying to remain safe online."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17844-e498-42ac-a6ea-4c13950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:04.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:04.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[domain-name:value = 'filegoogle.firewall-gateway.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17844-a20c-48a2-939f-4f67950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:04.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:04.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[domain-name:value = 'accountgoogle.firewall-gateway.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17844-51dc-4556-a088-46c4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:04.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:04.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[domain-name:value = 'detail43.myfirewall.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17845-d6f0-429c-b890-4079950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:05.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:05.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[url:value = 'http://filegoogle.firewall-gateway.com/servicelogin']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17845-8224-4308-a3a6-4702950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:05.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:05.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[url:value = 'http://accountgoogle.firewall-gateway.com/serviclogin']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17845-8ef0-479b-944d-41b3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:36:05.000Z",
|
||
|
|
"modified": "2016-03-10T13:36:05.000Z",
|
||
|
|
"description": "Phishing campaign infrastructure",
|
||
|
|
"pattern": "[url:value = 'http://accountgoogle.firewall-gateway.com/servicclogin']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:36:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e178e3-cf8c-4f0e-8dc4-4fae950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:38:43.000Z",
|
||
|
|
"modified": "2016-03-10T13:38:43.000Z",
|
||
|
|
"description": "Command and Control Servers",
|
||
|
|
"pattern": "[domain-name:value = 'sys.firewall-gateway.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:38:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17a4a-dee8-461f-9d0d-4594950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:44:42.000Z",
|
||
|
|
"modified": "2016-03-10T13:44:42.000Z",
|
||
|
|
"pattern": "[file:name = 'uroyh.exe' AND file:hashes.MD5 = 'ea45265fe98b25e719d5a9cc3b412d66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:44:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17a4a-0678-4fc2-985c-4912950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:44:42.000Z",
|
||
|
|
"modified": "2016-03-10T13:44:42.000Z",
|
||
|
|
"pattern": "[file:name = 'uroyh-unpacked.exe' AND file:hashes.MD5 = '5c030802ad411fea059cc9cc4c118125']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:44:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17ace-1a58-46e1-ba4a-4f89950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:46:54.000Z",
|
||
|
|
"modified": "2016-03-10T13:46:54.000Z",
|
||
|
|
"pattern": "[file:name = 'Reappraisal_of_India_Tibet_Policy.doc' AND file:hashes.MD5 = '7735e571d0450e2a31e97e4f8e0f66fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17ace-007c-4f0d-b564-4166950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:46:54.000Z",
|
||
|
|
"modified": "2016-03-10T13:46:54.000Z",
|
||
|
|
"pattern": "[file:name = 'Genuine autonomy or complete independance.doc' AND file:hashes.MD5 = '7735e571d0450e2a31e97e4f8e0f66fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:46:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17acf-a6e0-4daf-97e5-422e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:46:55.000Z",
|
||
|
|
"modified": "2016-03-10T13:46:55.000Z",
|
||
|
|
"pattern": "[file:name = 'Application for Mentee.doc' AND file:hashes.MD5 = '7735e571d0450e2a31e97e4f8e0f66fa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17b8c-398c-450a-bd76-498b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:50:04.000Z",
|
||
|
|
"modified": "2016-03-10T13:50:04.000Z",
|
||
|
|
"pattern": "[file:name = 'iph.bat' AND file:hashes.MD5 = 'd2e9412428c3bcf3ec98dba8a78adb7b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:50:04Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17b8d-449c-446a-bbcb-4d96950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:50:05.000Z",
|
||
|
|
"modified": "2016-03-10T13:50:05.000Z",
|
||
|
|
"pattern": "[file:name = 'cghnt.exe' AND file:hashes.MD5 = '1bf438b5744db73eea58379a3b9f30e5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:50:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17c47-9ca0-4037-afb1-4c8d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:53:11.000Z",
|
||
|
|
"modified": "2016-03-10T13:53:11.000Z",
|
||
|
|
"pattern": "[file:name = '20140317144336097.DOC' AND file:hashes.MD5 = '3b869c8e23d66ad0527882fc79ff7237']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:53:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename|md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17caa-2740-4d49-8b47-4c56950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:54:50.000Z",
|
||
|
|
"modified": "2016-03-10T13:54:50.000Z",
|
||
|
|
"description": "Command and Control Servers",
|
||
|
|
"pattern": "[domain-name:value = 'news.firewall-gateway.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:54:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d3a-44d4-47f9-aa6d-4722950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:57:14.000Z",
|
||
|
|
"modified": "2016-03-10T13:57:14.000Z",
|
||
|
|
"description": "Scarlet Mimic Malware Campaign 1",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fef27f432e0ae8218143bc410fda340e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:57:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d86-0c10-4c04-b412-4e6a02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:30.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:30.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1bf438b5744db73eea58379a3b9f30e5",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'df9872d1dc1dbb101bf83c7e7d689d2d6df09966481a365f92cd451ef55f047d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d87-9904-442d-bfe2-4dc902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:31.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:31.000Z",
|
||
|
|
"description": "- Xchecked via VT: 1bf438b5744db73eea58379a3b9f30e5",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '67762474fb66217bf2594ede3d15abe12ac4d9e7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e17d87-3b08-44c5-9dfb-486202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:31.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:31.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:58:31Z",
|
||
|
|
"last_observed": "2016-03-10T13:58:31Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e17d87-3b08-44c5-9dfb-486202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e17d87-3b08-44c5-9dfb-486202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/df9872d1dc1dbb101bf83c7e7d689d2d6df09966481a365f92cd451ef55f047d/analysis/1453744608/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d87-a608-4e4c-bdb2-443502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:31.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:31.000Z",
|
||
|
|
"description": "Scarlet Mimic Malware Campaign 1 - Xchecked via VT: fef27f432e0ae8218143bc410fda340e",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'caf76e19a2681dd000c96d8389afc749e774c083aef09f023d4f42fbc49d4d3d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d88-deb8-4f0a-a0cd-4f3902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:32.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:32.000Z",
|
||
|
|
"description": "Scarlet Mimic Malware Campaign 1 - Xchecked via VT: fef27f432e0ae8218143bc410fda340e",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '6d81d2ad1acfd707a2ea35672bdd76948889d16b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e17d88-f460-4120-ad15-4ea802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:32.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:32.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:58:32Z",
|
||
|
|
"last_observed": "2016-03-10T13:58:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e17d88-f460-4120-ad15-4ea802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e17d88-f460-4120-ad15-4ea802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/caf76e19a2681dd000c96d8389afc749e774c083aef09f023d4f42fbc49d4d3d/analysis/1453903417/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d88-9390-4464-b901-466f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:32.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3b869c8e23d66ad0527882fc79ff7237",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cc8936507438fcf8757ff40309c6057aa780c394b158723b7e8fb07e09793344']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d89-f498-448c-bad0-4d4802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:33.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:33.000Z",
|
||
|
|
"description": "- Xchecked via VT: 3b869c8e23d66ad0527882fc79ff7237",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'a7e90928e96a44b5223053fd0c1b96d9a3a36e01']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e17d89-a69c-40a0-9352-45f002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:33.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:33.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:58:33Z",
|
||
|
|
"last_observed": "2016-03-10T13:58:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e17d89-a69c-40a0-9352-45f002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e17d89-a69c-40a0-9352-45f002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/cc8936507438fcf8757ff40309c6057aa780c394b158723b7e8fb07e09793344/analysis/1398640507/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d89-4d84-4ac6-80a5-47de02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:33.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:33.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7735e571d0450e2a31e97e4f8e0f66fa",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8d98155283c4d8373d2cf2c7b8a79302251a0ce76d227a8a2abdc2a244fc550e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:33Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d8a-0c60-4f56-87bf-448f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:34.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: 7735e571d0450e2a31e97e4f8e0f66fa",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'e2126ebc4910ea0308a150466f70534854ec201d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e17d8a-d9c0-4638-9158-4de502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:34.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:34.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:58:34Z",
|
||
|
|
"last_observed": "2016-03-10T13:58:34Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e17d8a-d9c0-4638-9158-4de502de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e17d8a-d9c0-4638-9158-4de502de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/8d98155283c4d8373d2cf2c7b8a79302251a0ce76d227a8a2abdc2a244fc550e/analysis/1437647138/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d8a-4294-4c3e-80c9-48d102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:34.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: ea45265fe98b25e719d5a9cc3b412d66",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--56e17d8a-414c-4f93-8496-40c002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:34.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:34.000Z",
|
||
|
|
"description": "- Xchecked via VT: ea45265fe98b25e719d5a9cc3b412d66",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '95cecef175012f145df2e0f8255fe92f55f10414']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-03-10T13:58:34Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--56e17d8b-231c-4363-8006-4b5202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-03-10T13:58:35.000Z",
|
||
|
|
"modified": "2016-03-10T13:58:35.000Z",
|
||
|
|
"first_observed": "2016-03-10T13:58:35Z",
|
||
|
|
"last_observed": "2016-03-10T13:58:35Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--56e17d8b-231c-4363-8006-4b5202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--56e17d8b-231c-4363-8006-4b5202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/3d9bd26f5bd5401efa17690357f40054a3d7b438ce8c91367dbf469f0d9bd520/analysis/1453744600/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|