adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/56e17b23-c61c-42e8-9f33-463e950d210f.json

1431 lines
753 KiB
JSON
Raw Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--56e17b23-c61c-42e8-9f33-463e950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:17:16.000Z",
"modified": "2016-03-10T14:17:16.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--56e17b23-c61c-42e8-9f33-463e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:17:16.000Z",
"modified": "2016-03-10T14:17:16.000Z",
"name": "Malspam (2016-03-10) - Locky, TeslaCrypt",
"published": "2016-03-11T09:13:43Z",
"object_refs": [
"indicator--56e17b42-2934-4040-981d-44d6950d210f",
"indicator--56e17b42-6660-41c5-9f82-4111950d210f",
"indicator--56e17b43-d548-455f-9200-4155950d210f",
"indicator--56e17b43-02ec-4c92-bebc-4d1c950d210f",
"indicator--56e17b44-774c-4347-8d46-4299950d210f",
"indicator--56e17b44-65ec-4138-875e-453b950d210f",
"indicator--56e17b44-ffb8-4c4a-9d95-43a4950d210f",
"indicator--56e17b45-f64c-4a39-8dfd-429c950d210f",
"indicator--56e17b59-ff30-45a8-8d21-4756950d210f",
"indicator--56e17b5a-52ec-44a9-9ed7-4b32950d210f",
"indicator--56e17b5b-1338-4df0-8aba-45a1950d210f",
"indicator--56e17b5b-9114-48e4-8cc0-4f43950d210f",
"indicator--56e17b5c-a5a8-4969-bc40-42a5950d210f",
"indicator--56e17b5d-4df4-4b8e-83f9-4462950d210f",
"indicator--56e17b5d-5ddc-4c35-ba56-4e1d950d210f",
"indicator--56e17b5e-971c-4cc5-9607-451b950d210f",
"indicator--56e17b5f-defc-4705-9031-495b950d210f",
"indicator--56e17b5f-b694-4c8a-ae52-4ffa950d210f",
"indicator--56e17b60-841c-485c-871d-4bcf950d210f",
"indicator--56e17b61-6af8-4831-a996-4e03950d210f",
"indicator--56e17b7b-8b4c-40cc-b3af-4650950d210f",
"indicator--56e17b7b-445c-4dce-bd54-420f950d210f",
"indicator--56e17b7c-99b8-42f9-be00-4d20950d210f",
"indicator--56e17b7c-e8c4-42f7-a6d8-4194950d210f",
"indicator--56e17b7d-a1f4-4014-ac8e-4483950d210f",
"indicator--56e17b7e-a624-404a-88bf-4d90950d210f",
"observed-data--56e1819c-5dc0-4bdc-a822-433b02de0b81",
"url--56e1819c-5dc0-4bdc-a822-433b02de0b81",
"observed-data--56e1819c-d308-4679-8806-465202de0b81",
"url--56e1819c-d308-4679-8806-465202de0b81",
"observed-data--56e1819c-c0bc-4c8a-b723-483f02de0b81",
"url--56e1819c-c0bc-4c8a-b723-483f02de0b81",
"observed-data--56e1819d-4018-4a78-baad-45d002de0b81",
"url--56e1819d-4018-4a78-baad-45d002de0b81",
"observed-data--56e1819d-5740-4736-9b25-4f3a02de0b81",
"url--56e1819d-5740-4736-9b25-4f3a02de0b81",
"indicator--56e181c4-86ec-40ef-9621-4900950d210f",
"indicator--56e181c4-94e8-4e66-aabf-46ff950d210f",
"indicator--56e181c5-bd78-4848-8ba3-4650950d210f",
"indicator--56e181c5-59c8-4d80-884d-4762950d210f",
"indicator--56e181c5-7244-4243-b947-43a6950d210f",
"indicator--56e181c6-7e80-417e-a9fe-46b7950d210f",
"indicator--56e181c6-0a24-488c-b650-48bf950d210f",
"indicator--56e181c6-6d9c-494b-a856-481e950d210f",
"indicator--56e181c7-d8cc-482a-97e6-4f6d950d210f",
"indicator--56e181c7-b460-4f96-b94b-4a38950d210f",
"indicator--56e181c7-a538-4ee2-8455-4bff950d210f",
"indicator--56e181c8-f1fc-4c78-b2d3-4a77950d210f",
"indicator--56e181d8-b6b0-4d78-8cdf-410a950d210f",
"indicator--56e181d8-af08-4727-9662-49c1950d210f",
"indicator--56e181d9-0bd8-4c37-9295-442f950d210f",
"indicator--56e181da-17b8-4310-8db2-4658950d210f",
"indicator--56e181da-75d0-45b4-938a-47a2950d210f",
"indicator--56e181db-3370-4b20-bf82-4fbb950d210f",
"observed-data--56e181ec-aef4-4572-8a32-4d6802de0b81",
"url--56e181ec-aef4-4572-8a32-4d6802de0b81",
"observed-data--56e181ed-7aa8-4c39-8ae4-448d02de0b81",
"url--56e181ed-7aa8-4c39-8ae4-448d02de0b81",
"observed-data--56e181ed-083c-404f-85b1-42ad02de0b81",
"url--56e181ed-083c-404f-85b1-42ad02de0b81",
"indicator--56e183c3-d5ec-4c1f-97c2-4ddb950d210f",
"indicator--56e183c7-4d84-4180-9da3-42f3950d210f",
"indicator--56e2814d-6614-4f46-97f7-4351950d210f",
"indicator--56e28151-4bb8-4960-940f-4da7950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"malware_classification:malware-category=\"Ransomware\"",
"circl:incident-classification=\"malware\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b42-2934-4040-981d-44d6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:50.000Z",
"modified": "2016-03-10T13:48:50.000Z",
"description": "Download location",
"pattern": "[url:value = 'http://behrozan.ir/system/logs/7t6f65g.exe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b42-6660-41c5-9f82-4111950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:50.000Z",
"modified": "2016-03-10T13:48:50.000Z",
"description": "Download location",
"pattern": "[url:value = 'http://svet.md/system/logs/.../support.txt']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b43-d548-455f-9200-4155950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:51.000Z",
"modified": "2016-03-10T13:48:51.000Z",
"description": "Download location",
"pattern": "[url:value = 'http://ncrweb.in/system/logs/7t6f65g.exe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b43-02ec-4c92-bebc-4d1c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:51.000Z",
"modified": "2016-03-10T13:48:51.000Z",
"description": "Download location",
"pattern": "[url:value = 'http://iwear.md/system/logs/7t6f65g.exe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b44-774c-4347-8d46-4299950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:52.000Z",
"modified": "2016-03-10T13:48:52.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.219.30.254']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b44-65ec-4138-875e-453b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:52.000Z",
"modified": "2016-03-10T13:48:52.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.234.33.149']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b44-ffb8-4c4a-9d95-43a4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:52.000Z",
"modified": "2016-03-10T13:48:52.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.184.196.78']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b45-f64c-4a39-8dfd-429c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:48:53.000Z",
"modified": "2016-03-10T13:48:53.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.40.108.39']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:48:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b59-ff30-45a8-8d21-4756950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:13.000Z",
"modified": "2016-03-10T13:49:13.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIACduaki21kI4sw0AAKQdAAAgABwAMWUyMWY4NzIyYjUxYTliMmYwY2IwNmVmMjJmMDUwYzhVVAkAA1l74VZZe+FWdXgLAAEEIQAAAAQhAAAAjraP7VF5GtqNbYg06g+Vc6TMFvkKdZfjzWU8KdIg3E6BjhQOhNhCIO6NU+kMG4BMLhxezN6nlkQsnHSYXk2r3eA8k4ZkmsQa/M7MAXCqKuZUr/eun235yJVz90NnVw270xs3ebMzooXPlZQTZAznTx7SdLmTT51a/71pSuT+MEwZPb3/l0iCv45RGwdhqrLwWTVRtqZZ7Zvpz6yDbP3uxYRy5/qPTy98FLlnLMOv5JFlfGO0dK6YutRfzgjQEuBFE5wNMKn3FlGdx3tTurTsesHXZLbOJ9Ms5mWkdfXr8aEkBXggf0kv6prK/9ae1cEfNI54WCfyv8f2j9IlAZe9PwSmTUzqKTSoKxZsXH0HnBgdXk2fdOoqKhvPiNP0YkOfwKUYR47eHDw3v+RTx3uAX0u89WHss4c9TXwTBV+6kxQMRVW/9OAgNVVJDPdsbStyo/yby5bnWSqagR6LSHSiGQUanZywMI77uWahZntCJ3i6LK1ox/AJxsY5++OjiC4FLUEWUlKU9IHmqtMYiw6K3WkNjohYM+JS8OtU8gVsCASLf75lsuZ0VThyKyNwOjteAr7Xl7ywBZ++b3hZ5Rq3kyPmPJHp+ph0yfQ7R3XxAsXm7uYoirrF581U2Os9loq0zW+k3RokxNbVxbkvhfn4gwUQmF54aYT/jR8LCawE0Hp0ZvarY83fgs5j/4TqQuZW+BqmOcVdc0Z+uQRkiS5O8GfoMk0T1k1bLMCIGEdnz8WxpXb2r5OOGlk5LNfg0/q5xzgNOMVDnlvc999UsCEab+ga1X0eWePi9MlCWFvB+4172Us5R84/3wIXXrzvmE7cOLSQr6u9Ubke5Y5/XzFsGL+2uUOwJ95QIeewIG+o/mEfskBphQXC2+Tb52nfVV9KNZmj3ZhYKzl+3q3+oCgAFrgoOOvdRkiVKC94XI0EFl8qazCbOu4nENHs+WwHBTL6bgHzJlPsiYjv8Z4YuYxeLUhPBHjwZ/xb3vWVjS1KuN9oygVrp9Y+4grmoymX4doO7JqE3eUURuvvKMVovBpxJqwbypYV0hXljWia9810svBkuxZuN0FS9S+0sgi/7p40ySPsB2N7yzSaVepvBPJ3a/FaR4+LjPTAkQmkKNQ1hKLdcEA9t9KPhlbZKmlYb4V7miRovzMUV9celjsdrHBCDpqn2UkSOn6rFvw3LoO08ZHQraGWKqYEG7Q64m8m6okPu14hev1OdbTUJzwUPjUfrSNs63/gfQvpHJCCMC0YpbU7Yt+JcAQZW+tAuYKkz2SroyHsyP7GcCgfZVNihk8zbDnd61nkN5ULxZJoNoJvcXGbDVV6b68SvhNcK5m7shZAJs7Yr2rNMKwiKcj733wN7GVfcwsLOkmSoHZ5SOn94crMacQXxH3G20JJ0k5iGC4M8xCsPteLnx5kqWFflYXXhIWwvD327WIHw6TnKQdBYsRCGUTpWbgyB1aIUO3MEzP37rAwnRjZ8gRcWa4ajjxMlBrMhOZBOqS1Apfvq7H/zZLSA/6yQg3HQEWjhd57/vCNyRcujMeAu4GQSn4bn0/CGkYBammmS/K/NnMEJZInf15M9GZEHkzI6gEVGyI6bHXEb9mnYsbBmk/vh2k7wPdzoyAxADUSixlks3rHixgN4fY7lQmwOsmRBQayn2exPZ77w0suXJcZdINQfCx+4+4U9SxvA05d9a70HOwYtu1RuGWpM8YthiQxOqfEUygXORMKSUJSaafoxZzMcT1NeuxTu5vqC3k3chceoPXESRcWnzy7cuI+dZklEHzeoJcZkzVyhPJac/2kPyBaQ7hyWiOySWs8mYhUCaULDiVSr1yukJMrv0fxEYmxzvdMtIzcW/k1Z/MCv97r+kdyC+j6bf6lJnHyoVE3KXdJfNEnS52KFXIgY6hQ9tyxYynbC/3cq8SdZg3TlYdpyLRcmOLrHXlD8CqaxNKjb0rtVw0KNv2fBU57H2jceqU1rNNlABWnd1I/uTJVQVcmGKvmzFFHwpFbQaMFXOBaF0OYKfjO4+X9rZKQLKKoF57lencORoDsIdFR1ENN8sJUmoV+34Aq/0AulO2K9JiDuHUlxTRWb7tYc1QjDhucq756B0ps1BCOTQsTsXdl8h7gBviK1VWzIt1O/lesbrR+1SPwvjqSOO+m3Zs7rzVxNGZe7aAM+UANetz2tv2qUSli6kN0EaDzgLY05WK2jpq1XRHSxizSHLBPKY5UZ8C7wAlMkrMATqM9YBGwmFS3g0raI0WLqXpp6UXQJ5vfBKiWQPAswfdOpcg7OHxQ46sWx0gHqsvsrJNTsUTbCZoWmTc6HnvT3eAHDaulzhWRCaU0mQ9Ns1ibx3gZP1xJ5CAaAVAfZgruoRT7aDv2EZT6l7lFPf1651dBmOgRdRGVXTmcnghwExyNjmiLdpT29+gWcNvaZ8uUHbH+8BG99APY8vnIODv7jSC7s9E4KdyiYzOI15deUtyTQaLSgblTU3c2EMoSqI11pBvgMt4dKyCpH4hwnIudmkhIilcaxuSYHs1DMf/izlWPQ9nB4bvueNG0Lm56Nr6FNe/zLMZ/5ZkU7JAE0q9OrnJCxYlv0hUGIwnzCHPLSL4WRBZqKWq/axBxuDeo9npP4HOzw5dxuzHbb1/jrpZ+kLca7bsMDIv+8rAHxNqNUj7wqiMLvS5Lp/iHfIXZTCfp6mcG0RCMFF8so11h61TePwAxKSKHVsfG0hhReGoLfeDGiLuGQEtG0ahkhX7dwYEwJgAaPh9ju7e9FNRoSejGh7JxSLHuhhclbmPq8s5qW3xSMq0aZK7RcuvI7u3w0IV8pV/llenrn8oHeYD1/6+7EwDlSRzCX5WgeYHSUKTHel+Tb9r1Jqg3l5+p5q47gbZZfZfoycfQT2Pj8nSYUhUys+vEK5Jm/nrcZ3b7+21Q6vOG5unCtV5gcYVtLb1zB3lMUKEPRWsDuhhc4cMQYfXv8wFocmLI0gfHK4G0H5so6pF+SDzw92G74JukIhVaxHk1JTqtS0DO3cD2EG+rNvug9si0NJPMg9jGYLW8U+lruRsMrz7+3xttIcKot+N9vRoXoQWfere292UdnaFS3Bk7n2whZfEB8MUZhDYaHbvhsFvZaqzGpiGhrZU7cVuwgr+dhvJB7IGiPfIUkxKzkGqWjdcGAXpyJexWLtXumuwbXy6WMxAMnGvpvhsTWcoDH3VIBj8CvlbLf07jpjXYz02/PV0D2+IhPt7MFRmkN7p6+cuFlb99MWQ6nKBaUh9DaLP/fhp/u/mmMht3AHKsHySkCZQfc9BQu9r9YgT6PJdcl9k5aiwDtJChHz4h3jXCtOMhXwcXVnnzaFaYuFk22jYllyihQhg+qVWCu30eVF0Qmm5i1h1LnbCdklOc4yNJ2bI1YyE8p0bTpidBE5ImFaxqQZjBYq2umf6bmUII1Ag54KwXCwi/L9DELbpZBmQyG0hf4IRNYs+xXmBuSiRsjsdct80YkmIc+O3gYwtova1Pmt1ooE4lHoKUMmSoNuO2GG8+W2C2+19IFgexkIqcz4eFsD5CM6mrPuT68g0zR5wEJsC3nvw6Q46UsbmcHWghWNRi+nXweOvvZlEqkN+CpsUcJyNkDpDupM+BtZOcu3Ap3T0CTb/76aJtPA9+n5fkdDSboxMeeMcntFEYFpCRJR1p1tUZe05D4fUhug3mMJLn8iXuK1NP/y2L3UBPnYbDBAaIzVMNt8ET/iHx9i/yNScyxhP5rkF0DBpiB5+zQfjoM0QHa/O6icEST3i4MfV/koRbIMVzFnG5MAeKSjTJ+FpfIclrgLewwA3gdnmgSN3pezVbJeRT+7E/VZD0stmJFlar8Xj2IXmwo61FnUIXlEcUZ/zV85voyS4Vx09t2yOwCTQWEnXHt4LZWge0nVXEcGEsmDp1SEVyDu5eGJ+YDW7IHG
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5a-52ec-44a9-9ed7-4b32950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:14.000Z",
"modified": "2016-03-10T13:49:14.000Z",
"pattern": "[file:name = '5925.js' AND file:hashes.SHA1 = 'bcdcad140f85808511398d768455cd8e82aa9ea5']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:14Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5b-1338-4df0-8aba-45a1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:15.000Z",
"modified": "2016-03-10T13:49:15.000Z",
"pattern": "[file:name = '5925.js' AND file:hashes.SHA256 = '9c2756192ce8957253ec3f2aa51ba3c8ffc792567c0386dda9072e2ab7e03bac']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:15Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5b-9114-48e4-8cc0-4f43950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:15.000Z",
"modified": "2016-03-10T13:49:15.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAChuakjga9pgXwsAAK4YAAAgABwAMzVmMmU2ZDFkM2VkZmQ1ZWU5Y2IxZDY5NmUwNzYzNGJVVAkAA1t74VZbe+FWdXgLAAEEIQAAAAQhAAAAXt7n7BFHTrJbFAxPC7wPqS0QYnCFHTrSPKTZHFHNxdlUu3tUTrIzyOcUaLCz92mIXRicmX8mOXAR2ukcOUA0JqyG3cobfi1ImPdXzS9vpyJiROnOt9OxyaJBeFHdqqKxfxkIelogYMZG0O1jvOIt3TtA8xjqKXvnZ5mDGdb7yIfxrN/daB49oTaR9v3dh/U67jeoe1QIaqmZrhAZ4HZEP5D1oMliPVbHjnJ6B++SFo1J15e1Na+wfnGolu/Ae+UjUNP7RxBnOt0WrsJ5ad0eHR4t8XyG+RDI2maCKowBtwX/Lra1VuEGPodfKlvGbnf7VvuX+50oQunJcTbE4Rxi/M5VPEDIEhATDrbd1FvdNl/Dmkduv6PudqSAqUPngJW+MfWY9oCqPh4jMTsxqiJ3xJqexmIFogc6npGRPcr41aKz/0JnoqZcARTvULOlVHQ5n8LdpXB5YOsBwfWd6fpQQGvGw4xLUds01iYkVzhjgrIottiIrPeLwBHdy8kd0CAMHQIZx+ZG3M+SLOV75O9/BA1th5S8neYZzDau8HrAG9WaiqllRmUC7qvwnQi5NOUsg7IbvVhqnBGTyWB9p+mFJex0YVxkqG0qFnDooUpD1AsIHlHraMwlbTJje6MzR0mluLyHsu6yi1qcT92t4kXIpWpCg0VJ7ap54t45FbW/QdV1nHSDkYM6sJRtXtTC7tTW8r2CBQMIMru4C5hPIbZHWJBCpIRJVOMAE7DLCEZFgSW+cXFSggQO+L+BdCwRbJbr0ehfMTOK4sXcwsQXZ9RKqzwNlfgGvS1nT1r7NmIusBdy00gWLYeIG6pp/jfVZ+32K0uElLFL7LR2izFK6K3nYIx0aHIh9kho1RtE8+TcxWJNUWBAiyytCIwD40/KHbDIc5EEEc0+DRBh3jz13Xh1S3ojFlkXbSiyP2k0RNteERPoQce0jf6PmT8OGVsro5untSHPbRp5umXkLGNxrKsdNpBZWlFFQjoW0XLl7dMNyC/SqhAsoxtQ0quGlBylntNf4dT5X9wle0ygwaFX39zJSKFBHbQj+e2Tgu6C73Qncnqi2u16/jB3a6P/KXPGS6TRVK5HUiBH+bzJHDkeW73nND9FLDZP2MXBRTOZUfY64esZ0ON+g+iOVvTUc8MYPtQtRU1kF4iwn44q7DL1T+H80Ch9DpQ1wibmlqj/djTL1/W9Boxm5L3eq5AwbQCx/x9BZU4nsNdLsu2vqYIdgcDAuqIBmE05DIe8ui2BLZ5gECfEHM6aIamb2jFpHRlsL3Goc2ZJHNxeL90cI2smLtkqEcptrjoeQoXT2MEabmCgJQKreOeCRaBQg1AusQo6kygoQZxEewm1TsNs+WPyRTtwxVk5DF6ro14lKLbBWuSBWYGwQLLo0yrlajoKGGxOOPQyjGridmMrg+xDXRnU04jpYu0vgsv7QKcBN31LF48z3/L7YpCxqP55Yu2Zxx7sFfzHbu/8xulsOnV5LKt44QzDbQj2JNlJwBJ5PrAERbWqqPy7WW4AiltwBqJ8SVrXwKYVerpndGqmq9b5OnLd8sBzeZKyaM9IVcOl/atpvMclOOoFGsfAyvvqLdKedDewnigMlvs9YoYzx2E6t/OxfQAQohF/EwqFOQBpHLs0dKjldGyCkZiUaCUVvDiccI3Z0sPOfzSlqsIlOItE3aJBhHhwivoi+O1JkNa61OCtA/kPU+/L2JPDNzd9AFd79ttWFND01cp52zHsAvNw9IAUlAfsOMseSFoAI62yttL1kt4X4zV2a7GdkE+wM4GwqKc5/LXUMOk/yXDz7kyeddSN0dleTMRoNfrZHUtrvt7mzkFapliXTKzcFwP0dYtySSlqnDOZC5/GjTBupX/cBMs5Zf51szq8EmSQmkqUx6tPy6P03yJ4BB1T7otKAbx7fwQc9hAEGPv/nExYlZoubBQHPSY9Ciiulu/CGMcKZWP0eHC5+kXELjWt1Ftd2Gk37EjbjLx1cNoNqquPEHRjtHjn9QVhzMx3OHqqdtXX9LimtcKOkOH8iK+Vwqv29AZRI7eiR7AHNDXIucOUOMAM1sp/rPp6zesFiTKGhkr70jdrI4PE+DMCL7g9OSJymmG3d0yVynUyHljBtR6+m8gWhr53gTK8esycjOtNHXZpJ6e/0GO3eFzuGSsrVhcOrvrKEvx3GLalbMdnRvmtu1K7fszRVZ6JVqnL9y1U1FXiEuO59QNGO6Eh5x29bOKIBC7rhpbvEvantFP2DNXzvsGw6x9HQVC47WqokzPiemBf3fsqr2u7eQkFoQ+FPvFHNNimSFHzu5g1khucMkNNem/9AC7rxG+eOL1xLHOySAUmCFkm5IZep2kRF0Ym/47ZXGHuxLuTftsvDrD/+y2W+BXNHrNhvSbP4eGWd7WHLHPOtJEYkbeq9DsxSWN8AzKBHKcgefH/AKfhLcb631kxCi4A50lNAkjxp2UdlBHd9b5gyGjHsCyBn9QMJm7EEx1HE5Kmbi1EP6QH73NnxURUAT4yFoJKdBVK17Mvzqj8IBi43kyveEF7kBDs2UIERRbm0YkH/4cJq3pW10X5B6iob4pMgfgo+ZtM1wbwRf+SOp4eYMA+qzTycTd4iaQLtWhrK0h2cfUe0Av6EmNQR7kqgXZjaZ6QBejoyf892LKUgGQIRAYQ+N9Sojevf55VBB49sBqcsEP5QlP6hpya/IqZ/oPKQaOUXxJTMXMOinIFLA9LH3EErJhENn5vm74x7KrIMPKomINJU/dhIC9G4j9BBXHc4r2vZj4YYs4EDzJhi28grRqvYMg3yt3zridUOy87YCIcuc1/dzfA2DFCeT4PPA1lnwWxMO7tdMzDr9Qb0lUXD9e+/4pTHAPyvNh+CczlkyJW5yYEl1U3NWG+uNxtl6pG5dnAfwoCs7ozbnVp7BW7/Z86URdXl4ZFb3m0WQJbL4/4JIAyeX/A5HgaiWkfA0NHTO/B/xaubDnMtXUa1vhLKH6mh2MAsKeIxpb1lhHQ1zf+LE3wpQvzgrw+y2a/pVaacDv1GnoXfg1mxg5RDzE1wAG22KtdkAcqZ+2hozAH41hAPFfrLM8PdVaP765o4n+53EIOd322xC/ycCvDAEZ59UxT7GvHXlbJ7hivIu4L+8EsDKUpcLwigH/rS80ryRpmpx0HLoVHp2gjw8iK9hZxRnozNdxB1GFPO78Dg7HXAkVHf8Z7wU4FvW4my3VoPduKEcY5bZJJqSrN+Qy1lD84271aqZVTtIgI7tUYFmeIrzMwA3lwalEx7IAlFtDwAJRcMk8wgNoRhgVf/bs7M0o3ACay66vZd9nIIrtfELqrnA6wnGuiRYz+RmgIxiLClYCDBC+C61uqUsywbNDod0gS7PfNw5bG/ka7Lyk6RUjglLWGnn2XBXfrT4+SZKVdXC5V9rLyl8TyJQSClOPtXylTCdq/lwMw1uKPfb6ifHwfxOwoIJ4NTFK/oubtmI6JHkjOvLemztc8UFTMo69y1EbSqFksOhDMQDfWk+POOhvxYoD+c+eAG1PEVYey27XqD5n6ATwfOUe2mPpv18YXWOtZIebWWxUIDxYCv9xZe02VGlxjwv+zo9oszZpsAo9GnSWyiqVoEWC1Wvny9trnFMdyrtPiG0HtsNAIrNfY9fiet+1eh5qa4EyjnL5a8dcqTqz1qGR0YCA97/oecVySI0Jid81A5lHbz0+z8X/cxWhwIvgYpRVCS1rQXIOP1I2Qg7ylaq6OY/5tshS3JoQhKu2WMd3T4cEbzen7s6biki2Yv3OkFRmprSATbKWj7RCx72xzPkYP++f0IupmBSKmzxeytfa6YzYAIPvCvHqOJOdDmUm6QFAbj1BynSPHFhUtcboxgajVDSxv6KEqm9ErKc2cTYkz5PfHQlBLBwjga9pgXwsAAK4YAABQSwMECgAJAAAAKG
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:15Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5c-a5a8-4969-bc40-42a5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:16.000Z",
"modified": "2016-03-10T13:49:16.000Z",
"pattern": "[file:name = 'HBG7116825504.js' AND file:hashes.SHA1 = '6c09c759dce8c2e4294d4133044ab81a503c137e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:16Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5d-4df4-4b8e-83f9-4462950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:17.000Z",
"modified": "2016-03-10T13:49:17.000Z",
"pattern": "[file:name = 'HBG7116825504.js' AND file:hashes.SHA256 = 'e17987421462d7a9a19f2e51ab18c969ed4064e722c5b305664e020343f67118']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5d-5ddc-4c35-ba56-4e1d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:17.000Z",
"modified": "2016-03-10T13:49:17.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIACluaki09PemSAsAAKkYAAAgABwAMzg4MDQ1MGMyZWEzMzRiNzc5NTk1NGVkY2M0YTVhMmFVVAkAA1174VZde+FWdXgLAAEEIQAAAAQhAAAAjraP7VF5GtqNbYZlH+BQ7KWhlqhvp3L9/V8ZS66c2TFxwRNg84h6hplMOYNWLkMAAUVOXaG4pLTsEn/XR/lhfEY7pbiNdw/c1xkdzRW9arNiAedsLp8/Rh/MdMPnWRJ0pj+3IN+15IrBho1YZgTM9qVgB9Nhg4sgrl8CCVixlnxfx/BIZaW4+H9c9rq5/e1v/dZ+H9E4dHYnDvKsBpEXWRcz2DMcX1EEts/PQGTRHYlDJ7Ngzdm/pq2zM4l36XfC9/sR4kM1c+BO02BwW653G3DBHfMzinqZVcQnEAWIZpXI1hViAe8FVSHso2XEJ3iQHDQ4DRN7gdg0NI9JLxrV6AV4jiuYug8r1nYp9C3yd6rxFjp4V6D+SeExPpu5uQu/u9F8g4hy1GE/8G9cU5ABjTuagQeMWkeWVoNY76c45rxbyw18kE2ljvj1yGkKx0S9ywWtgAKNwrdaqIA7cLDA0z/yiLQ5pAxsJouc2Q2AryLs9XMV7nP6pcrp0Stx0uu1j7WyxzXUS9rxyKetyNWUTCAbAl1HUMLGSQQ/YJW89t4NQbT+c9QoYT+B0N7+oVBF2JYvWTfwNAMxKClbQAMtvUp6VKaO1z43V3Su/RBKQMo8/sBh4nQV1+eVaw+vByqi0NseWzvH6eb1vsPH1tUpm+vwyKzvO7BPZ8jc6TVqt1YJt+zRMT/NwxDsn5lsKRGFF7jHsUKnckI8V2uNRN7QHjOW47cZY1OPxY0Lu4vVnJB/hi+jJZHs/BwRGaFgRkHJRkrJ+hviMkdraQfxDiB2Kv0rgBkm5IxqBeEWT017Y6U69+EjWRlG14AqG1AncSHKaTDGMBnOyaO3Oxe+r9Vm3DPSG8lWAzoRuqpdrIU63QJvizwRmSPGJia4KBlV8t6n5xZlirCruVh6nYnk1dTbQnvUux9mc/YX7g5EsVjY34IMUBuVDBJxNm7HiLTFUG3WRGA2NEG+t9hOw3uDLR7WO5bZ/Qdjuper9roCSTZ0DIoKjmors/IgzEkm2P3HGo8mTiU7F+NFwVbq115rPPWpm+M+Hm27dOrUKXu3UxEFY2QViQ9ExuffsCCXou5G+Xrt/Ig5Q1b2iSW9eG8bo4sSuXuP1GuTYQSjnMfP29LKsjE/ja1Hvi9VGuLW8rjUyEn+G92t4bKdqpGelt5l+ZCI6O0P5dKfsyzOQSKulshjC69tXkwhB70eXRSacc95WNl2l0QO534PdyQ2+M5X/aeGFp1L83teofhOdP0LCQ2JqlGgBVBO5j7HNCqndinb9uI3gX2E+iB1Q0uLGoBanAnpUZLP7i+CP1cP7OvFo8sruhOwq34JTE48ovgEd3VkoSGx7JlWvDCuaruh/QlZIyyr86RCmj5nD9RW8C6UjnmB6MZqtd0zpizAocsOFG9KRET1mSfNvFNfB1WjpoSNm4m5oCvhnvoxtNDxD8eQDwzrbhAILZb8wMA8mpCeOmUGVGVXZwiW7K6G+7KaEbHnNUDWkjQ/JkKvMpLo4wjvk9+zzTcuYA6SC8ShVRun9Tb8ZjkHJ6xTUCCukUWep/CpahztLPoWRVgZwhbx7maBnh2Xas0qsp805RTH9gG6EP0eABl8GCYjKBNutWkD8Ov89jGiv+d53lYob8Vd7If3F/c7wlM5s8rWx2Vw4dxocRPtd0hpNcsE+gHwpv6SA/W+b5qno9Xdpvrj/LkUE47k00ksyxkHE++Xs4F83iFanDoZcfA+yYihwVjJ9GLdYqXfePp6/jkIQUFWqqn8aftHVcfmZyGtDvYG06uNBQK7f9NkwsbAgC/5G3o7B72cXTkuDrGLrdCVcZprU7TgX8IT5Jaq2aX2SqlUW5iyN4Ip3W1REftMIUyIEYCzlVih5N/0cBzuYI4Uj/GDlgzBMvfIuRvD7CHE2tbKFwPKSauqFQkCCthAgFmuyZxEV67r2sVosfJzoDXvbqRT4qrTCj+AxVdE6tTI1Q5dAkaWVgg6/0RyCtZAzXAiLyT7zs49rIG1ZXvDYhYcR4r9Pgx3oI8+Lua4SSeHDjxXLS7uILnNTfHD4MdIqx6PCFjeo0W7Z+DBu7q1fWuAF+5HKir6rTT3NdD56d/3f15oOanzjHwKH7BrKBYJm847er5CAV9hfTZYOXlPEHxwvYXx3D3d37SDfQYWwdBOcHcTtLpIlHTVtqc0yyrGnyqVxi2vh0SY4o6txmamQxfaYDfTF4fA8EqZVAgmtjA+QkTuQ3mFO3OigabfuNtgAtndYRLTgcUwh/wkFmLJ7uBujNyYEBNw4PFeqiGpSx9fw/XjVd0dl2DMNW4RNacoYSxH3bHOeuBKh4TcmDdQlixJ0/sEC2CymoO0kkrinh/kU/IMXRgWFx9Lgs64uSU+dHrSJAlURez7ov5pABvA3X6eTm1jQQHBuPq5AuplOgD0sXzaqLhLYg9TGqcnx+af6SSSCe6+GfkhfrKMRKjIcHl8QJa67yWlKu1ZDsuLsiSmYhv221DnFce6JHcGf04XOpdtSoa0paY0ZZ8aYmbjdZhmreZm+f3YvcPQJaRTBc1DiTJK4/5cqDI+2TMlCcCIc3QPgEqlWpAEBq96IFbYPSsEh2RCK6fFFoS8MvEKd7IvlVDD4hX6RQeiKDCiwLvgFr6/IlV3+mSPxImbOHDa5D9Z7tfic7r3MCeUYldZ/dLUaqv4BH5qMNdFg2t7S7ip1nuieBiiQUfp8k5c4HkwWQ1/KS1QkCfSjk1fJzNVS11eIofGPlWBqR62OmaEJAohkbK+ERkp8lt6I5aRdkB18NGVPYt9dWsTSx2hAV/5/qGLHbNnxw35cJDN139QVriJncZxyIzUes6vXPk5ygEHNXtuJimnF9mtC9OHYsinQLf9zPK4c00bXXTIWEpQY6hAZKdV826qvG0SKs3stjLUF49tSG6ZU0XPIh3xH/5Xi9MBqu5QTKKCmQRBf62+XpSj9a9PzRwuDKs4N2W8+zW9B4+UisGE/fAWFCAPeqzBoHbRgcM24KUM7IzTYxKvGX+Jjjne43D7M1i32ExXyjRSzRg8h0yG8LOiR/e6f//PB6q4x3IjMqpaLly77eh+GzGMeRZ31ShianxcvywoTMA65WL/HtDU6Lu1BCJ8mcRLEVsd2yUF06O7Q0eMdX7enp1J3BwxDL+DoyG/BY//r1bo+qxDq+K/GXBlU0kLIXOzRPsWNvgEpOKu8ddNyFAFgMdwuWH1cN2A1Pog0WD3GZwbqRbxOYm/zS/WWWCLULipd0oaBe3Arh9rtOcrtJ9bQUHwodSZ+xHfrBGdX7XgCOaaM9SJzh2Kz3C1yZvHb349MJe9XFumUgQM1sT3D6kZ4RWqeRfLiDkAr+uI61IRj36qdJNzgG3fui0GameqwxDvQRiYTLVPq3AtN4iy2OY+tpyk1I1ej5NFBXNLRHN9Frn17N0NwZsfdqKHmpO/IFEeYeNCc4zWsHJ5ytHmzvwksuABPhPrzz7JpN6LEAvbEB2GgwEYaCn9rLSCnqbZZLA7D+SNc/+03LPpJtHamtsmdeHlCL0dbFJtDwRFF8pg1EEugUT4jwycMtYeaJeEY2ipln4ov+ppJjYQwGqsjmBjnvYHxPhHPKWcLTbE+cj9sCcbnmLbFzgcJsafNz+wBTAXCsqkH65m1EfwK5xxxDNSdZ3Er7xbEO/nl95aaS50tP+66n1VSA243MKlJ/DxQA7CIOfzV/UTgkmitIHnzNUNLtpd9D+49jCyLdxfDffDv0oQ6DaIj3xUvUV/aMVzkAANSIKYrQ3ITomsi/yyucZhb5K8aifZGhECNsvHoVcUaWQkoWmXo/XvMa/eZ9QtuMpclbLHjk9akdNq/7dRi0044gkQb9eFZ6VMw4NQSwcItPT3pkgLAACpGAAAUEsDBAoACQAAACluakhd6horHAAAABAAAAAtABwAMzg4MD
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5e-971c-4cc5-9607-451b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:18.000Z",
"modified": "2016-03-10T13:49:18.000Z",
"pattern": "[file:name = 'PIR3470678806.js' AND file:hashes.SHA1 = '00d876ec10ffe7384503f61825725f77726ec815']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5f-defc-4705-9031-495b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:19.000Z",
"modified": "2016-03-10T13:49:19.000Z",
"pattern": "[file:name = 'PIR3470678806.js' AND file:hashes.SHA256 = '28c82a080ece4a206452d20798e21ed463fef1c968e4bb498dd1705cc4a50ffc']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b5f-b694-4c8a-ae52-4ffa950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:19.000Z",
"modified": "2016-03-10T13:49:19.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIACpuakjqUFbIggsAAAcZAAAgABwAODZiMDgyYjgwZWM5OWYxYmMwOTYyNzBlNjcxNjZlOGVVVAkAA1974VZfe+FWdXgLAAEEIQAAAAQhAAAAn9T2R8WxHEnzuxcSg8UnN0ARSDzwhM8GScgOBufAgAEddaow4XWx+Ejh+0BIQ5WakdAXSGs4e/nYoXdGBAARoPCdBC6kBDB8jSfGb/Ie98UT9iHCw1QOEw0qeFXPxLFxTnvJ1BnGehphbOXfhtoT9F9rjcafktrG5CSOiNigL0vNCbV1bVZ6wsJemHfBk4RfKwSwSCPpbjsju3GWe3NObi8x0L6ltf/kYVHBpwZVidoXwytAYLwhmGpFrVyE7KR8qE1OJfz64PVqTjVaUakdR+GUkjYROztgN6H6lGEyY70t8pIq7s5anOLwG+qrFndA994YbXvXfiok0LZ/MH6AIbg9W9ZVf+eKFJI6wGHYuMvp1pJrC3qLKaydUVj/SZqP7/z7XPT+i0mSOqk08NTaXscmr43tTLtnvyGFbZ1vc4Iod1bkXCXqiGmA83C+OMAMeIECIxW3mBNZ0rguzAOpSjC6obZVHcGwkrSCpSj8uPSVAEMIShHRBbr1164lBHTfDj3HprGP4MICqGZEvrykiy5keo7HZOOhjaKYIT5wi/Bu/gltFQV2MOzVVyzVdN+JtZmKWZXD7iYLe+rMRWmmtq9oS50oc9Dzn0u2SYcnNaHMhgljQjXMYaW+MPPbAc+3aCuDEEdXsXP0hBUUfIVRmugSeGSJQNHBmVErYIOgOxydCO0OsKeeZuR2gZReMdvay8v2DtO2em9X2x7zu47naTzfEMYree0QOwDqzN4/pSMKft0hDWPYU51IJZ8v77QevOYwmyNTucVDbOijyZx+L7Rv3a5IzxckJU/mONNYHB5ENEbkKFkQkgnL8iCdw391NtvnDXPK+dLmEshCUeJkNJ9AaJkfTloSKTZvcD6ao6nM9CtIQ/CBAEIfJcjCz4hFIItBTz5V1gP1vG7gLre+HpySAs2N3cbYNOZcMHUV/+cfGbq/X2siDDPkAE/R+jamPlr8VX74ME0UF7Mbu12Ll+v3AcLFKhJZyhW0gYqH01QqqHA+L1QyIgPtvC1RNTHLYJwbj6RZZBjl0MrPDCdlSrInmJyRp1wtrIVI8DrdmX7MWXOVhQuY2ir7y9QzwocklZsfiePrwYi86kztmISOpZdLPNLab0ds5x+Z6pAp1ETL3Qrlq322gOL++mGQCDv2JHbs+AnJLvGQHtTcWlagrlJDtjokHzA5s8Bjmd3tzCEZcoZfP1O9Nsv3BbdQ5KE3K1nyq5BpmbgAQg6KxA9aNfqNeBiWYFi+tz6vq7LabgrBQTBmsImx4u9pXBI1qzI3bOD5OyUDl0Y41hVLvPfa1OQgxmfdIz4Qv5POD6wC6KTFRwWnkCOENOFzqqocZOQRXJZziu5mByWbdUmqqOhy8IcyGbkLT7ReHVOUjonOXYSrIt6diC6bY0L1txlp9T6D4DefATr6K2pIWmqffSyWNTLEOvPg5eMayf054i9yd3e5FRkKYezwECl+7mTdYOyyQIQZOOExZ+GKQCOAWBpeYx27urSvOin7PH6e+/pd/LQwEk4UpwNN+7JbcPx4UcWpwXlWnYJmEUGFQJku3bRGrS12VLr5Jo+Mgjml/S7mS8qm+iP4ESIFNJnhQkaCglsFdm9CGnwFI7UmLoVJrf7ovpYmW9GyTzSuB+cI7YnIwOBI4fdtle4kuDAi35n4ScHfZ74ohmIc3hwp82xXXbjziHVdiFgzbFIjORthB6jkNcDckeS81jib9Aw0vVtanRQbiJB39fCD9iuIdrL36oECRZ8GmOeNW0imwN8VzW6ZnEUfHYglY6Qi4gddqt81gqNnFd722luwvjjmNsU1SXI8N60D0Dv2hbs4w+lTM4JCABKNvtt3mEe0IDDJ2QN4XSad+B1uE3dzKvAoEVMRHzzJ+yv4TSgZXQ1nBefGkfpz8K0ZbRmCHaLg48GLYCWbm7DBMdcwF45eqhl/Xy/H7VjebebDkvlz4RVzWdt/FRh9l2BpjNIq6Fq+aBJFYA4prFLeSjJrMl3qEr9aJqydZgG7o7NBVT6CM/RAhLD11ey219JNwy17aIyTEzuZzY81VV3UXlSBWQnEm63Q1O8lsbqacyLfB0Jp4lskUU0LFaFUJDQSlIY8wTSUfT6ugiglZ1nqqitKkp3URB61uNCEIXfZ7fRumiaLCK4aHmI/qWxyMDJixYiea8najR/F/XC++cGkKCEdTxcZwxj+fDk4jLAC7TCRzsqBJjeU1Z9em3V+RX+JOtHwSu3h6GmovoJ1dDX0siSviRQ7sPbFY8v5v5/26rl/p/BuNMg3hw+L+eKiDC1jgnS6iLrtHrFPmVomtmvnw1OhFNrUUZr8mPKc9Pyf6T7HPatd658HwXApgpYv05CG84cN+1ou3HQTb9ghrRW4/J/Xin1Gsigu3bl9oIjTj81y5uND5yExQsb1sukRinAyN17DgqKsDYS0kbxQh63RZgumsxmhFjCRrC6hxW47VQba1w9soYystd4xL7ZVN1oIVkxP0BF/6KWYJ/BuQh2tIyVQQHkp2S2S2tMr2RMlrFZZsStrNEdc9o5F31vvUCPd4faPVuCDzHzLuGyk2WxTL2Jpf9v6vR1sjoHhksj38PqX7x8+L2epTg3KVlDFkTCgIRZWFb3ZgylpKJMapvlbyIalGYU7jD+c9URSkP3r7ko8cBQ4HpoIpJ/dMkItwQtwCf6jkz6wxT1grvmr3tXS0Fk01e8I+bbyW0aZDlOToft0lvSQGNEz4oMSSJ8LBFa3NIjPI6mKdk9BWU54Ua8qGNN8ssHYnibTFbvH2YFnlo/dOsTbG60DT/rnGSEklvlDDPEG4rA05jSrmU6K7WuURPupCXajkCLTHGqM50W9f3UVu2Tz4uz4ukyLXVfl2oPRtspUmQ/3jYKfkBV7iTQeo8kDmujw11/d0pOqF2vv2cgqzfOHwAbDcUO95kpKmotOhqqfGJ5DpUtP5MydFurTcksQrvak/N0wE7cEc0JaRIOEYhfWX0caVpGP+tZBWWkc+vI7D9jm/2N6XszMop99m9tBYKbAhwF+8JJrNXFey6z4dFFDinuKkeaOdmapL7yVaxknfdogGBfB+t+2BtUFQRXmQtm33FK6VP0zZkkSLiuj3MZ8N72Flh7B0S1wblSvsGdVL0J8XmmUso611gddSdauvSQt4e7+db5pORYdxqeGoO2qIf7I5XZw5bhBwvjeVGR6+d4NCHod5Dl3tyKlJ0DhMMJfCrrLac2eU8aGVQiyuR+g+zLvNFbX89rRIZL8WfGmAP+7dNfGPdZjPyc/22+R2ObszCYtzhFjfkRDRah+AtUrvaZuxe9RNvya1i+gFkmZEjjoisfxgJ1NFMOXN3jagGNJF3V+wDpZ0b5VPfjAqyQ83Pu7H9xcz9O8w0pqNTYQM5xff+entWbKd9bvs9SChBbPgoJP+Z80Nx7QBBG6YSJEWJsQexFF50BtOU7oJ1kKZhRc6jQoR9b1uodaTS7CefmHYPTecs9sJgVCQsSuZLAzJfjAwXuPTpqX2ndqa2vYQ1pPJ11YCKkjpJ8ylkGAxEuEDBlXsmCPaDZgXqP2FMuFfpuv6lhAJ8qjGU6DDDL/Adt8EdW5PhwdcdAMDU0R9e22dh07yLGyQwhlJF6OLD0IZ9muhUN/X+CVcnNcfxa1VabhuYueAfumPgvWCc9IdbjDtOKwpnPjwyPuFIv51lDP1pJvDiYvsSRysTsKyut987gOOHpyrth2kacd1J/etEEW/UvCRX7febKBgq7SOtlEDzWYAfO2VcQBt/GfH65e3nhMY/YvM5WMUpmhNtUKTfCRx2vB1Pghy+E2/c4dh0vo0zujJwksL4ihejMLXQ9MUPKgq8EZBJmPrzEpAeGX4PrzOJo0KF68En90EhPLwlo8/S/6+MxmMBmqKGLYRQ2n/rPHBuvLNSn7fubtBsf0WnIrK8uTl+
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b60-841c-485c-871d-4bcf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:20.000Z",
"modified": "2016-03-10T13:49:20.000Z",
"pattern": "[file:name = 'RXO9365969307.js' AND file:hashes.SHA1 = '3e5eb425b5612e7d30aa39daf62f3f0ea09935ed']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:20Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b61-6af8-4831-a996-4e03950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:21.000Z",
"modified": "2016-03-10T13:49:21.000Z",
"pattern": "[file:name = 'RXO9365969307.js' AND file:hashes.SHA256 = '80bf97beb00368b37ef30a3f3db3d6db060e69dbfd6929c451eeed51e6935e08']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:21Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7b-8b4c-40cc-b3af-4650950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:47.000Z",
"modified": "2016-03-10T13:49:47.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIADhuakijdGNbC+IBAAAQBgAgABwAN2E0MGYxMTk2NDEzNmFmNGM2Yjc5OGY5Y2E3ODhkZWVVVAkAA3t74VZ7e+FWdXgLAAEEIQAAAAQhAAAA5zfkUFwBi8C9Kw84OsSWm457PrThLhkLuBq/MNUsodvIUi331Y4c6VVXOoGqqMIHGefwYH2uGrTmdm1l7wXm2B+N2xenn9kMXoYLhdWat5GHOsYZ5i8nFhkQU0kkXOSBK9mUC/yKJBLb8hygCLZGO8tVUSy13QWZPlCTPryNbIq9X2HdbuuQnVCoZSysa4sTQYK+Oh3JmOFZ7mD4ks8JeOHUue3e58BLjtrz6A5V5hY6W6YglIKd9si/JuD/c8PMY8NR2GLf9Ip7yJBL56foqIZgonbDyIAVR11UXZwrJ0OTU0aJlyzhhPDrQCykeJJFE38jEe04ueU2ATee2/lP+LfGNFOGTy84bCD9zAaz9tdcLpx9hd1SRCkr+kYJWVgkzoFmLyu3/zZY1MZA/3HpdbHIEwWk2q0pcVJAFx6R8GMOIqIMJbobVPQl7+JzU1dKT7DKKnLjkY4mDxhNtjSLTS1At9nWVXgs6pSMnKvEIpxd1jjTnWAVgl8rEwHrSRoTVmfJz/pl/VROKyIL2sJLOQvNVa//lHmrmzPYFumsQY+8tvWc8Nrh9JgK6OB+vpQ4zh2R/S9qBAzRbnAuwPmivWfRnBuM0tpIyW4T/xoMdqkWgX7FjyumVN34IlB388Bs7ZGdDOrO66L8etp+/JUnNnbFqdgJVLjc4mqKLK4AYJ3rE3Tf5/JCvtat5+svUDti5scPpri+50WBAKa63Gsne8kDhI8wwekV1HgZpP5pevHjPQCiGXIlhKpzMeYsLwSbnnBRwJ/mnMFBxz17MdkpWVUw64QlSG712JR+bEgdMAdDfkGkDJUigK7kYr7rBYV2rANsN9zrauUDh/7NHRe98OffU0+zeXcvL7uqU+miMHPzGlocNqr6Qmuy2H0pHmrcJfDBaUCh2lc27/grbLON4GlcgZ+DS7F8/fs5qLNmy8jiNEpOpjEctKHWetDwoitpoQUgpr0rqr+KJXoG/IeTcbdzhplWB0WSw83Yd8MF4aApxHjlk8zUA6FmZOoGrdchsU69EKc7El0KmNk965vWJe19Pts+e9mW3PqIjbTaQAQ3Bt3H40e+3OSD0zoVBhQoq5WjhRideZP3ctLEIgXHFt8Pv+2FXRxRR2CS0y1xCDQ7im7XWS4+gOyvVU63//KotCOLDm8qSnljSJxDfScyNJCM6ArDbje0KCHEoqGSZAwkPpuxD/J+QgxADNAT6ZBr+ogql432yds2dfS9S9lGGGwB+FviSzV5RgsNK5DyR/2QuDkuRBe8+a54e7F6jmpHVnIit9wx4rayO92qyvHVh2UttMDPEz9E00PRYH9WO8MPULLuEx1xDFNqyx63cSBU0T6AGxdj3+mDKmlSDE7KKxeR5ggOjVpGmpG2saTdXsgQ7Cq7Hk61rJqi62CkbdsemZheEYbFhmYf+aUTE9G/YeXYy+NSsICVURkHRw+4S2KoM9KaiRmAn1mOaYX7GVQW00im2ujvHqDHvK2U1cd5LhT9oixj8Hin8NROn6Vj/X/7TLEyNbOAGCjtRARQA8PxXjbbweKTv6e51ndmijwDejOSeMF50IB6xKV0CAHKRzimVV4SCyXjeOZoX90TNT8C2vtuum8EPokLILytSptnMALSZtIfVsn0je11IyhiEE5XwyEy0Kh6LcreXdIiA29G0hto/3ZRvyzR25L2Dlo5mnpbFBqY0opsn+f5sZyykAPyXCSm69znomgPoOz1ycqcu2Bg+Hw60B/MQK/5hTJRWEaEx9f2ESiVPMfdSt9KKmweaSGcSNZbnmuTgDn7rooRlB8R+YN2nY3BgRWgGNlSMN4SP8J3fxUTVMk7RlwuOr2R0aIRsiLPB8/1E8/IwgmDZevmABUxBthA6rftHH3v1IoZ4PLWU6TCZp37LuOlDelUFPfwNRzoCcSWf0rkf+F15HJJ+r/LkN62qfsi2mxkI5mN6rCo+rK51zofSOvi1U2WJen9430BOaY4V0uZjr8viaPXHUe/NHwRHqwxQ+MUGvrks/unYzal7M+u982B8uhEoyMD8NQmhkrrelUct35LYu7qS0+XYaMe6G/+0griFVWhZC+qd2qWJ2SCTJDEz878JVqqYmgHZD7O1HIcesTem0J2E0+hWQ3KGSkIr7FisCHB1OM4zYYSkMqWhzBQL8f9JNWoFrdu/XcCG/zC1/73wtq/CJhBXJ94PW87c4QoRwA2e+k4cr/DNCDocYBea8mB6IfFyzBh13XXfJZndiuQ6/n1YDs6LCb8F3dWx96+53X8mAtsVbtsacROnkgyvMoDUQxKEJVOpF0sUSrc1iC6qiYunjSqAiGld2QD0pDRX/S4fdOQUMtinGWCujxNtSdbgHXWKnE19Z5U3kpYLbkvRjK2voEZdkSoQQM4bPa9JuWM8m7WEAKdJuibKY5aUFC/ovgIqWOATUHizEKAA+yeGxIH5iYj0BKUSQr2ya/NVUFWYNGJR2k2aO39g9He4XkH6Wk9s5tWqVXB4iQymr7bKT9ScJ833o849oeVLcF1z6Vp2/0f35TbmAi/vv3CzfYkA3z0HsOd5hBBxPs4NWIzGbP1UbLPHgq1jY0g0labrcFQAQRcG9FTiccBH/G8Lz7ug0WYHS9fEF9W3gyEzJllAxqr+6Wq72NK8hLBgRRgt42jGQGWvo6QEchLyomtD0AMQea7hhU+LOzMNPup2lwXWX590bTX6AY3lykivX9BTY3m7UwLbBAtzURjmqlBcO9VPKxYGlOjvTmBN/hwlfLsspoAS5lHPyeALZs2n02QhYqdrQi34aNWSjb6MxEP1fc59iUFJyL2S+aONgZVI/XEKy2+ajKLL/ywlPwP9o7Y8bwglW4W39xhAY3lRdzZE6pD69kGO2tB/p41mKke2FAwQqyiyvd6kI2qoC+fSl5vW6nS4hOBrehCqHNx4aJOvAOWet2+l9kpjo3+/NuGoqIt7z5kjQ6+lap2JI5Ebv2Aw6+ReY0k8UH60Z3I5FXderacUiYgaY55KXK3JUDJOD9A+j1zJIij7eCKYgi+E9oLy2AYutXBLJvP4T/UvexSldMzksWGMqavrVJCx+3SGR5KTHEggibwttN2T2mrea6O/5jr0hPO4sujmwxGdFzz9KyYrcL0hCHHq95v5QtikQPQfOaT+5Ambm3d2MsuThBqp3begANd78/3WaZU/uRUzBpkFLAZ9rb/yoqK+1Pq6g+JQzZqvY1yyA1Mpdc1e68RQLMKzTJ+rowEcOna8yVTZqNXbGtvn3Q4/xb0g+g5D6y2w6gqX91NympJNo0tGfWHxtGOjhX5EHyQPhUhp43Zj+0cZriFx4SluawkrhQXitgdZhbWnPV83YzEJqxYsrz7I7h19ssXy1Zgo5N3gzhgLKJV0ulAG+r81U+trXh4gh3s22dPemBbZif/qVQXgqdIQ+nptc85Ee7YQf6Rqk1Ux+gfF1Et38q4ncGjlV0ycVGsMAdi7jdj7gJZuBfJqrHJqWgQi4o1MOySf/6zFJ73RP39yemlFJ2kyQSXTb5LrXTsLhtQO/dBIlWJQB2E32xVLzcWj4bH9kcZjfjS9GmR5O45CEG/wl1zp+9HZGAlO4sRDYw22gJWTR9If3rvEgQ/deNumTMjMfLyqEhVmypjws03Ze02jJmCx7QzmktXo90JJoBg2Q4bBy7hSqVz3KeYe2kbn2N331M5+psJI47K+qISeyctzYV4Ph/hMhXrRAR3apl8LlQti/SpWcJlIQUm09gczPabRU5Yjh5f+klqkYBJFn0EqcE6imR/em/zOx6+5hFESBMQsphUTwuDoy8adWPXAkN30HY+eA7S3HOGrJJ6dFaIAu1/cUCjM8kdoTjD89RxV9oS2PJcZmGQMlwxmaAiSW92Tb8BOslIcNVa25lw4lcvkTCLG8KWCFhJY7Sp4Wn6BbCcrgDvwz
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7b-445c-4dce-bd54-420f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:47.000Z",
"modified": "2016-03-10T13:49:47.000Z",
"pattern": "[file:name = '7t6f65g.exe' AND file:hashes.SHA1 = 'da08e56eea5592d172a2e77a866c1b95087c3873']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7c-99b8-42f9-be00-4d20950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:48.000Z",
"modified": "2016-03-10T13:49:48.000Z",
"pattern": "[file:name = '7t6f65g.exe' AND file:hashes.SHA256 = '31a8da82168cd1f63855af3fa29f27ac9566b1945c30343898b73739eb813249']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7c-e8c4-42f7-a6d8-4194950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:48.000Z",
"modified": "2016-03-10T13:49:48.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIADhuakgSTlqu8TUBAADqAQAgABwAYjU1NDI1OWJiMGJhZjM2YzY0NWQ0ZjNiZjRjZjYwMDRVVAkAA3x74VZ8e+FWdXgLAAEEIQAAAAQhAAAAxJVsH/h0ILTWEy3Idfzl1FyM2zKLNT2VhFaX/P4YOv3YqBICHDBezJcXdIYMqtnT1f/TpJL6nFPXEw+m2lgoG+fjzAKxStr13PjZkGs+XBlir8cGq6LRc7AsaTNrTC+bWvJghWmH79vcID8CY+pWijcTvjrccEJaSJ1SfmGtBLDNyPUPB+3fuMYUgtxha0DOK8V5QuouV6mOoOXlmWfVfRl69EOXVbBqYoEmi6ZZji0qhD/sVdv+AmCGGh9pZgQdFGfPr9At7lIp1vkoK7nhSeiLTTMcnhZyw5FA5RwAGmXw51Mjrs9vjPBQd/yEaLDJ/c5Q+5AlH4BFwgLN5dUeMxZZOtTLp1TdlDYCubAG8n2SNK2w9BaKcjkBvSzMb9LB/DUdCYIZNiAhf/U+Bc5OoNwckyjI52BtFDpBsLRKIGtcrdUpfLfsuxdCPT8K6H7SujQny7hqYu7LoUneTTj4zQrkxgowOrdJ2SaZE9YhtzbXvhbXI9r3DucAjtFw6xWBGvhYnZttNWG2ktRtVm94j9HuNlqazZzAFyxEn5RTbPdDMXSMrF/ALImEhYNzGi1S1wyfLQaBnlHgqNXU30bfu00LkVHprQkDrn+w9s+ZqT14DgkIaIVcMcLYaVz4Y0q6e/5wxQyZqgTU2JbuzD1MxgbLaSjlRyU1ol5CVKhgN09GjiyPxcx8iy5Aq/3rHpXbc1PB9OzTR8ih0SbtzPmxt84RYZ+d0W7A7D3eHPuTPdUJGkXJA5irll8Og0wO7pckSIpurLk1jLM7blJoosJYZFB/3C180lBRDRvIyxN53YjfGvvAqQbZQPqV9RvMBa1i201HpYcA3QGkHV7asR20jECas8JnXiKGWAXAYnkEvC2Rq6V+Hdl/kCi/pZB0QZKNe1kwWOkc2vc1WmH0CBhPG07+fx+bGlGr/EoyhNn81V+/ehh6k6baWYa8Md9PSYaQnR3P9nHcXwllVnDVBmZG5f0AJG0klH89El9S7FBmYTz4Oqt7pe7JbRquF+yapUMxemNPzuv8JdMnWzOfQLG6fIW7X3YBSxOEo/QoH8Q1eq/IdKt4eN/U98gR3LlyXw64PqL2J3TSP+6FzkLVz68aValTaSwr+FVWikeFfFIUTT31woZ2SerBmqrSGq1L2ai7+vHalDjktGdhBIbYslnwUx74bhBHklK6pGAPnry8fxAqe+ihUt0A3zmTISmzi2FaIIEodWudDkkkDaU4LrOb4m2wOVxW5RkpSV7+OecdATHYKG/P8S51iZ+sjD5g3/PGjm7pP9AkrH1YnFa0SmQScWv61gn1ktnXqUYrkDKsZlK2X8NQWFkq++qIjYTb8WAR32cSyoQY9Ps1FViXYx6zAuXcu6mtMFegq8/enbM3VYMfYv18mNzith3VicyHRTzVQh+l9zHmtXIrLJZ1FtfSi8GviB0abpZoV75vyYL6COzDRMqHWQT7ojkXR3MkuhoR9TnNOX6uQoIHPlvZWK6+l+S23oeQbfU1xhVB038MYkizeGCVOCYAF1xB5GMQ605++2WJk/8lg+y/DzJ5W7qkMM1MH1b4XkF+J/0dRas5pYfxvI0D2lqv3igYntlcJVvjlo6+5KiONHIPPQhYybu2DhUTEu7PBQtR/ctpn/3eCVLnxnVgSzrjUxamb4MCZHoeCeIfbtGxbezQhLJGwlMdnQ0yVN7rJcRwESt5o5ADgqOgLy4zyJ77x/8Gljpl1f678x3a6+87auZuTYxYLqY40SbWrHGc/9GXvEcbrVf+tZoaB8Y+bt6pRIXr+gqoHaklaCL+VQxBwMrIu0fPSVzA5SlHTfJYzsBUr8N7PjO3y6jAajDfqSozAdzWiEksVJdnjXtAfFm3qfpBLjH2iF/u34HRpMVWFB7yGMkUs8t2SYlJcqI1DlU1LbRCYUxUD+LSbvZ/RdH17E/NVfsyNqNuCn2SdNPlodpxTIVs1c1AZxQ/Ang2kMDdjOvkmwCJuRD1L14FjUK6E6Z8hvKkconsnfXuHcILa2Qhm0SiIKqyTSQ+odZ3IdP0mRsxBlootcL1cmfBdYi/e+HLzC0glWb51juJt0wmSrEZ4QvuJZRcdq9DH6SZwl7MA/pfWaU1anbKzoqYHTmtK8eAPEc7cdfGiWBaaSgsC/p2f/Mj6AWjK2Rc5GFQj9Joy9QnhaAuEwV1OVVaHR9SmeKnD4zxc+ZSoVRuUL6lEYj9CI84QjbUqANG1X/Z6Z2FSLCRHhw3b99R7XJ45sx5buoFSoQSPUGySnnfBwvShBa6mAshtZl2UQ/qehUOcqkuffhgLuRfP+CiQP7rur99VQxGjqkaoA6n3Tuyry8D62tAG/2M6eEE6ADAe6HL1vPFKGWwzw+57qbDdVtshSwF5ImhTOPuNX1V5xItp37Hrk/8VYiGAXM6h14lyfOM+0kWem33oLl8CpfynR7LkHfhEVKT2htDS14yuKC8PbY1hM78Dovyg9FHo2fIznZkXDzUSGQl+U2vs3b6o8X1Ogf8YOgMt1SoQ9pLqOo9eM6GIwR1DzIyw65WRSzduitHPBXxoQ37dRAC+66S7mNUOGSfc0O5nJkrWIm5gggXmw1HgSuFfSfWFigltbV4oNLf3HqCYDcqxXj9lTdFg3Zi4ZS4u7BP6AQhxUV/CPnjDy/isCwW/bSN4s9fDzrYUtoPMaz6SnJW/9rPtY5WAIT/ySpUMgaSmWoobuxrZ/KEkvVHywa31YjH9oaEqKrcjYoXrqSGnyohEen7mB+Tm7zIRwq9G4skxo81Jh4UY6AMO7IcrYWzSa1lKLzYz8cro81UQ30rEhrDm6f0FIJ/Rva7V6DWLZpa1MW06uLdeIHxxxuPqo9bVJUq+4YMJxwZmb+9f47Nv+bGVncYI7A6XHWyywoI0J8isGg60pZv6KRXPDCQyt8Br4XqhnpkMJb9lyV8KjWkuDJDiev/bCbL1KO92EhT9Dama4pAPSpDQGM+hPq49Wj52WMduifEf4zaGLBBTjwaSpAkF9IppDpltJPSGENkiq4Pwy9KPw656EPq8rpy8LpPtCpPQlH4UDK5txMUgjltJzz0sYgI+laBoVVsS5hoI2zI1f3bT1eAxcVdDnNrTm9rVFVFdZQvddKTEYm0gJRoTlaxgJN4dotJLroL4ir37UxbhXN7x8I2hzczr8msQNJE8pXiWUp0egF209fgcXGFPxO58EtECWsalKC/t/cNp+tk+vAtkDr2aAtYeEV/VNO1Z+dLcpBKrqtdXRcy+eQa9AEuxm9qRyKyBDx2qHkrnFKjUNvu9sw0xxYzuTcQVxz38N1uynBbXd+lv2EHzg7vfIEcQrWSeVkLsjKZbQcvJtERKoq+jG55qiptxetu2JBtvzrYnMk5a8SS1OPVpK4xjBab0PtFDSNZk1Hs7aW+Z6n5nPQUnWS1v0LqkVZe3gmfOIhhNfuKEFXG3fzgaR6BrozDhMuwJre3/BQMIQn7PGZwU1wlOzYJTUcvHxZKbPcOQCIW3EgypOITf0i9WXbalRpmx21t5/h3uxT8Er/qmWnat/pmngnDDfcyh8MI4n/r9Pajig789JkAOyquZYwVgwNDE6fSXCwd1V9WJMyvb/PJlUMYEN7UPvQszAfutrjDaMUO79qyDb37AIkj0e7zEDnFzhnZV9OmZvZL5cHOUWxmlcovVWE7Eu2euY13EE4n+1CMQ8NLLa3LAzz0T0GYgWH5ONC4rZPVPCx4iF4K9IRhvPEb2NgdcMfeArVBuShNgcVz+sz6HVPYOPPxS1+8McntCE4ciPAcasb1jQWqFDNVYdPq7AZbkDGzZBgeF7YOinOSWs9ef33ub5N6TjNywkVvqu8ezrpMGi+iMdXho+jrVxPq5Aowgs4JmA1tJyaZmY/+yxPuV3M2LMLRE/QRx7oHmwWonAoDjWZc2Q0prq1kT7
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7d-a1f4-4014-ac8e-4483950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:49.000Z",
"modified": "2016-03-10T13:49:49.000Z",
"pattern": "[file:name = 'support.txt' AND file:hashes.SHA1 = '9b2fb1ce362f3bd48fe8fa2e0d5d1dc025b2e2b0']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e17b7e-a624-404a-88bf-4d90950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T13:49:50.000Z",
"modified": "2016-03-10T13:49:50.000Z",
"pattern": "[file:name = 'support.txt' AND file:hashes.SHA256 = 'dab169740c3b4d6612f6614a50b2cf8ded42ddc5fada1830ffb3c8690dd6af89']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T13:49:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e1819c-5dc0-4bdc-a822-433b02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:15:56.000Z",
"modified": "2016-03-10T14:15:56.000Z",
"first_observed": "2016-03-10T14:15:56Z",
"last_observed": "2016-03-10T14:15:56Z",
"number_observed": 1,
"object_refs": [
"url--56e1819c-5dc0-4bdc-a822-433b02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e1819c-5dc0-4bdc-a822-433b02de0b81",
"value": "https://www.virustotal.com/file/31a8da82168cd1f63855af3fa29f27ac9566b1945c30343898b73739eb813249/analysis/1457618790/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e1819c-d308-4679-8806-465202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:15:56.000Z",
"modified": "2016-03-10T14:15:56.000Z",
"first_observed": "2016-03-10T14:15:56Z",
"last_observed": "2016-03-10T14:15:56Z",
"number_observed": 1,
"object_refs": [
"url--56e1819c-d308-4679-8806-465202de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e1819c-d308-4679-8806-465202de0b81",
"value": "https://www.virustotal.com/file/80bf97beb00368b37ef30a3f3db3d6db060e69dbfd6929c451eeed51e6935e08/analysis/1457603038/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e1819c-c0bc-4c8a-b723-483f02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:15:56.000Z",
"modified": "2016-03-10T14:15:56.000Z",
"first_observed": "2016-03-10T14:15:56Z",
"last_observed": "2016-03-10T14:15:56Z",
"number_observed": 1,
"object_refs": [
"url--56e1819c-c0bc-4c8a-b723-483f02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e1819c-c0bc-4c8a-b723-483f02de0b81",
"value": "https://www.virustotal.com/file/28c82a080ece4a206452d20798e21ed463fef1c968e4bb498dd1705cc4a50ffc/analysis/1457618405/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e1819d-4018-4a78-baad-45d002de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:15:57.000Z",
"modified": "2016-03-10T14:15:57.000Z",
"first_observed": "2016-03-10T14:15:57Z",
"last_observed": "2016-03-10T14:15:57Z",
"number_observed": 1,
"object_refs": [
"url--56e1819d-4018-4a78-baad-45d002de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e1819d-4018-4a78-baad-45d002de0b81",
"value": "https://www.virustotal.com/file/e17987421462d7a9a19f2e51ab18c969ed4064e722c5b305664e020343f67118/analysis/1457613420/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e1819d-5740-4736-9b25-4f3a02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:15:57.000Z",
"modified": "2016-03-10T14:15:57.000Z",
"first_observed": "2016-03-10T14:15:57Z",
"last_observed": "2016-03-10T14:15:57Z",
"number_observed": 1,
"object_refs": [
"url--56e1819d-5740-4736-9b25-4f3a02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e1819d-5740-4736-9b25-4f3a02de0b81",
"value": "https://www.virustotal.com/file/9c2756192ce8957253ec3f2aa51ba3c8ffc792567c0386dda9072e2ab7e03bac/analysis/1457618850/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c4-86ec-40ef-9621-4900950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:36.000Z",
"modified": "2016-03-10T14:16:36.000Z",
"description": "TeslaCrypt download",
"pattern": "[url:value = 'http://hellomississmithqq.com/80.exe?1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c4-94e8-4e66-aabf-46ff950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:36.000Z",
"modified": "2016-03-10T14:16:36.000Z",
"description": "Locky download",
"pattern": "[url:value = 'http://hellomississmithqq.com/69.exe?1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c5-bd78-4848-8ba3-4650950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:37.000Z",
"modified": "2016-03-10T14:16:37.000Z",
"description": "TeslaCrypt download",
"pattern": "[url:value = 'http://mommycantakeff.com/80.exe?1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c5-59c8-4d80-884d-4762950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:37.000Z",
"modified": "2016-03-10T14:16:37.000Z",
"description": "Locky download",
"pattern": "[url:value = 'http://mommycantakeff.com/69.exe?1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c5-7244-4243-b947-43a6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:37.000Z",
"modified": "2016-03-10T14:16:37.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '91.195.12.131']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c6-7e80-417e-a9fe-46b7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:38.000Z",
"modified": "2016-03-10T14:16:38.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '149.154.157.14']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c6-0a24-488c-b650-48bf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:38.000Z",
"modified": "2016-03-10T14:16:38.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '151.236.14.51']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c6-6d9c-494b-a856-481e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:38.000Z",
"modified": "2016-03-10T14:16:38.000Z",
"description": "Locky C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.235.53.18']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c7-d8cc-482a-97e6-4f6d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:39.000Z",
"modified": "2016-03-10T14:16:39.000Z",
"description": "Locky C&C",
"pattern": "[url:value = 'http://iogwedoil.ru/main.php']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c7-b460-4f96-b94b-4a38950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:39.000Z",
"modified": "2016-03-10T14:16:39.000Z",
"description": "TeslaCrypt C&C",
"pattern": "[url:value = 'http://tele-channel.com/wp-admin/maint/wcspng.php']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c7-a538-4ee2-8455-4bff950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:39.000Z",
"modified": "2016-03-10T14:16:39.000Z",
"description": "TeslaCrypt C&C",
"pattern": "[domain-name:value = 'tele-channel.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181c8-f1fc-4c78-b2d3-4a77950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:40.000Z",
"modified": "2016-03-10T14:16:40.000Z",
"description": "TeslaCrypt C&C",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.162.214.146']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181d8-b6b0-4d78-8cdf-410a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:56.000Z",
"modified": "2016-03-10T14:16:56.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIABxyakj6Off5cfYBAADMAgAgABwANDdiZWNjMjE4MzUxODY4Njk2MzYxZmQyNGE5OTI2YmFVVAkAA9iB4VbYgeFWdXgLAAEEIQAAAAQhAAAA6JQbp3VqlXFNG9MwVYT7WyApj37M3ZGFXH6LNwLutJVZjWTnQN/E5iS9CbsHLpgofWVqwVQWr7RXGUVzWbJtY9iU44XwEAwddFPWJsS9/hNtnbLPpTwV9/r0vAtDsMJx+EiIbyv92jbaZDuQJAsLZpvQ14+yPfILCJLutCl5wuoM0mMQO0/H1YqbLCJIGOcFad/Iz6DyT3v34itJbH4cLVgGXipQnBYktu+rHe8LsxYyuUSFjyDVB6H/t8KajkX4SNVHtbnsxwtTmRwG0CyQO5NHjsoDrxNb1VwYMaHeMXXuQ2K6PVLG/cjgwtx9i1Je0bMKypgCM5bGx6y0LrJnyRGHTpiWCi8lFnyZillG9FaTRBwSUhzF3rCn28Lo1t7mFR6dnVd28UWz0uQppHkQ/ft/zMuJ0Pq0oKi8xA4YSw0kckRfJEMvdfzq6OcGG4r0KEJsreaCNVM/IhJAMgFYlIugI4+UoShTCaiprd0qb7Qu1ETmtxhdvdafVd9WZpqP3MKBb5I/kHmEPeGWPHl5Sox5/dZHXDQ+1VbYA658ldF034OMfkMuOvOiESjsCzvuTP1J5i5q0cwYNUg4i5VZ/dlH+/K5x6F1XyBWR8YO83t4Niu2U+eL7qaZvqHxYz6zW9UwLN+5T2Z9MRAmm8eKHeMdQAniHo6Fnx/kwWjYyk4AsU0CWImPqRR1uRk2gtnNGOP9ghdz1fNLIMxH9y84A33WHldegtFXE6MknmxAPGtfAYyon3bNVsSo4yQW6DDdW9hJOpIHJ8uhHcJroue9UJshlUrk8eTEaQj9ahpss6005rWaRXXCpokfSXKzrHOAlZv+07nt9pj8TmfBvpUMFcO1OilMhM6H4+tG1fMmDbJz5VoVoq56TlN9eT9I4wxTbBLrxtv6AuvjHY3gIGuDt7Xu+9K9GIBBTZqszE/RCRsJV2uyghQGJG4qYZqzWRVF45rsQ0Lm3YC/UpfsU+Nr7eAuZVKcp+656yZsn3Y6+rE6EWR4k8y9tDdBJGGaV3pkk8Usla4XqV/WbhXjdax8kukI/VduacCmM36sjL1Ye+UhQka5Wo/VVIKudV9rd/+74w44Fj/XpurAOlI3NgjUx3Yv7Jq4B1v6vz+JpxADDkah2pSqe51A6wY5Dzepoh3/s1ihrhXhJRhVEnlXO5tBCYAJ3IDYQdhimuCPXDNGWA+kjrAmEzwFe1IJcUyzbLojR8QnrF0ZNG+PZM9IdfRdP3HztzhiTig8a2YcxKYuYUY3NnECrwU8G8eZxhVY6JJkbYZt5hcNIBUUdQuR0VXJJN79nDhYMnQlLiRKnemx8gaDBe4gXcVaWbdBYUsujj4E5sfIJCXy0ELQpJBosoOMLH3rrIQVtNUgiJTIkV1Ra6TR+S2PtH7bEChwaoAkp5o9I7CBTEexx89lz6Db00bmjZteGyO14jjtgICTCeD72O2WyrflDkjLUxfYoPSzH8Y6raomMuo+T1b6s6BYnSZngviN1qY0F+Sn7DFM8DHLLwtFbkY7e0I2NSKCBjt4U2VR7+bcPP5hk4Fy46u00Tv5eKM+fgLOSDgal0nGLqJmknbTHjuk8VvDcp3dyfrdQDGWj6cf2UjMH9QfGYFpfHUTcVHmb+wpeGteEWvm+4ySmsNOLMvmDrKGp3c/4B4UgzoIQajcbD1BlAWBQwgPGn7xNTfncRZz4uaXQJYJpvIrzia0bu8U9122Ty+3DuE1wf6ZY6/clmqJutXHs9DdQiZb3CMnnACcFIILEw1GPw17AagXIJeSs7rrMY3gPSNjegZlUmX09c1oUWJQHvauHBSmBdcoC5AzvJthckITnj731IadGdeqoEwCnBoDpYYsX/0gI8EwBxeiype7q5ardwyZ8MrZhc5NsknMgyfZS+VebqKCluJqDrR4ts1NE5DqFWhV1pExUfDF7SJ+YS7q+qRD2S/OEr3GEuo/3IcwT4RY2obg8j+7VyzrQUKDm8fznqrdq5uh2y+A98CX54sDGnJqYNraOIJpqeq/zuBktpVg10t9xBeGnm6sQuNl6MD4Btm6wOLD4lkQZlaCTHxZnxG9StzuToiC9YC154vdrt204pgN2nfalqmCQM9wC6PlWFHFsHr68Dt2Z+fpkpZF+CEwbPBBrw55b30SevcTBzOXR6c1EnvS7zpQl1Znimsf5VkYa+9B9InMIelF+uQvcMVTrZkWPwc8dy42tuyDMHEs3M7yA0SUMic4ToSIHKjhhDJPvEUDysNvpvDQJyaUqn/ggSUhCujP9xRJl8ccJeneiKx3uh7gRtqZfBPhbmargVwDPfZ3DsshP33NmSlo3IUJBspVgimN5LOGeggjZVWd85asXbCc3tAYAXIN0s5Mjx0rbB3MxlmYMwJYCpRN8VE2omg3mtFoEPZXaKft3ATWFqqxm72koZjV7ScSYJJdRKhHe69GBEEPULA9kM7YxqlO+p6hfHkBVn6wT5T2QhjEtIP+AbOgV/v36xOikVTG2JCilCklnonj5D89amd7AI0EFe1VVdElCRFiv1o42cmEDkSFEa+dR2W+Z0J+wmkhzqWjU498TMtMHE9CVQhKiThJvMeVoEtyusn2TlnE+HyFKbt2l6OohkUMptkIdz4C7SB5VxZBeYV5o6CT65be70UecMpGw2A/MAugA3aJ4R0SkganzKMoE77VIuYsOAf5RGxHn9hjBXawdgPA7Ki0fF7cnxL+oJbvvz+6ky1fpSmyRuPS8ri1eziE6bX9HfnfwELBx4z+cpWTpxw5CC64vNuL6c1TzSaEMl5rjUyo9RFH/nnO97IGHUTrY779WLUk1M19w6hWiPUUg+PGDcFg2ycUTEDX+ZKhBBj2rwnaTDe2/0nMtjEfAxPvxGosT6uXv9oy6hm1jeLf0QubfhScf4odVRInpoJ73sItmAnXpstmLDZ4PzjKcQ5AIxVjjdoqUkVWqIKWtuZ90Y1bVbUzBRg5qC1byrFps6bOw9Lyv1SYkEMFj8dN6zSa9KMCPGElPsR1WVXdr2xwICeYhblsdAPdP5iuSzQQHdQJrvWhFEd73a9Cpou+3uqxj+/c6rpjrzPuV4JrYnOalrUzXMBhmFeP2Jdgi1km0sZYSeXKXIePkwZSrQ9w2xkYeE/Wg7S3FC/57zIvt5k27TR1lWuEBGkhvWIXRVpK2LUlfhyDHnjykTc+/33A+wrSjQzAw1zoCBmueR916vTu0lwcAkhR58fM0/MpLKBspIaJKrKaaZRMzqVgvv0lCF97QSlM/oLx5ipQtW8ZC9+OrNLvXps32O3AyFD1KRNuw4neOWv//aWB0vFSMREFIld2zxec4LRCbhQ0dtbudsDYDXRtMrO9cNdh78jKxa5t9tIM7UAue7jxwaPgeDmWpD1EImn9hBC70y/9uf74KKS2o47MYT3AeGgby1Q/tFjP3WfCKostqlHkbyzQGTZRCzuIfmJzjKerALGBdKGTwSMMQdyOH+TBN+aFujbxVPFYqSu1kDCbj4zjfmj9l7tJhtJYPHE1qk163f8twL1dkfsM03Glb3amST2oNZrqrxcVwRdIbPBwL2w+UtPvqI7KcI9C9EU1lR6oOtMXBul8W/CqrRXSuiV9H06Xed0bC92FTdGZwYgzIFBsc3Y7Ez2OCHWPbocAFzx4fXA41UqfsJZSMkV2XBw59c9EIUE71z7QXsa74bDrD8dnSeRRIAVwDeNETnY6z4o0aL8YMf4I9LpzMv/PdiXpgqNt4RtQPbBmG2AHbqqHKEK3zsdJppfeBIxgZCboClJw/oxU4ze9pdNWPdpeiQWLyw+kuGw/sjnhtNZzpNlE5jqXrt+uc2codHCsEo3QWoBCs51NFCXsJuI89n0fh3LQTOp4b8/6Q4ztpwputmQcLSVBC6T9k+JTFtgflkMzT0gNcZz4ODbM4tVfC53r8r
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181d8-af08-4727-9662-49c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:56.000Z",
"modified": "2016-03-10T14:16:56.000Z",
"pattern": "[file:name = '69.exe' AND file:hashes.SHA1 = '4f39182bcce347788ca8f2b10b0f93bdefdecc78']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:56Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181d9-0bd8-4c37-9295-442f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:57.000Z",
"modified": "2016-03-10T14:16:57.000Z",
"pattern": "[file:name = '69.exe' AND file:hashes.SHA256 = '1d64db20e038ba848f2720138122bf08e98cd647da33d2d448ae2586596c9ef6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181da-17b8-4310-8db2-4658950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:58.000Z",
"modified": "2016-03-10T14:16:58.000Z",
"pattern": "[file:content_ref.payload_bin = 'UEsDBBQACQAIAB1yakh1K7UB4s0CAAAwCQAgABwANzA5NWZiZTkxYmZlZWYzNjc4NWZkM2VhYzNiODc0ZmNVVAkAA9qB4VbageFWdXgLAAEEIQAAAAQhAAAAs8j0LqOGqTHhsOyykvLf1AidqqDCtLQoCiQTYM1ymFIYw52oily+Kfv/XJRpZs5G1Ub42pScGKbRLe+GlKDNleo+pYGf9R3gnl9/yhUSVemcvBbvXwkXysl1Yl54wdJQm2QAMBwgGzQZHoYA/Tu+mnMekxLSZAMrT3buhOiWADnUGcdHFZQTdn0a4PhXqqVZGnCgBtv6AzVd3Nlnt+Nqhl0sOmjHJZFJC8syhgJ4YFntODIYfPT7It3/jmlskuluUa7R0sIG9IBQ9byVN6hVANEQgRmDwtaPdp/ASwZhBTj0gp+HGxoW5P6PkEkkTDwbINRnxwNLtD/blFwQvX/ZFBW7cKxPvlq5Wg/p9GUhR4x7Py3C9euXi44Q9FsEITB4zYZl5O1Ve89PNKw4KQgR+Xg0NqS0+ePIWg9w98zKFCLqOAM2u4XD6o2ui1fRktY45DsV82F6pwmV3Yp6DLmFq1WAxO8W7AkzouteLlM30CEBmfgXe/GDZu0BK+TWNdXevcXB4RrT6H4DWZvW4ZGlXcbCBcELEZerLMpILd6yrhZQE0D9AdlV9g0+3I5LIyNPrIO1mRY7pW42ehXe8WMkU2HUh6CSr/TfP1hGhjNmG0JxZFx1IMMkQFCxvfVFgSAwDDfcDsT8gnhzJrjSBoB0djinyFKm807bWS5v9aRWDpjyz+Ib4PcOu9mfIDdRCjh95JOUvk846Nyzdz4AxhafrDmQ/FnJUzwD12IJYFn+4fYlpmMRNXUqcT3JDrIlNF91cQRLsdpBsvHo2sdicfLZkncbGD0IqXMfURZ5DMlN40KzYcpp5ayvDXpJz4yi/v36ayt9xQaB81SiNTOhO0RuDCsFgrNuDxXo++QEGwLcYc1mRk6iYsXAPoF3AIQEA5z9JJrESNkViCbm+oEGEKQkhiAkbAZWTnkjclMoiSYQ3q9FXl2LPoIpPQ5+WWBKp0rg0MUNxKoznTKCt0jF2W9FNq1PM9ceYuQ8M2DeIwJlg5vcEzQ3U7/SgiNYv7k6/yb4s8XvaeG2hzASQGc2Fft5ylRp8YhOo9JbZypuqFyEaMAd6Z6jAwC7GNTFtGC3uayZnWd1d0PhAZRfni4CAKMnT7/biWIWUXPBildCGdkfJ677K+q9Y0J0chKZjbxWDeRiBq1rnrJRTgOMBIaojn2em6cGtgssd46iHt6jvykenv00PwiAcByizdLaFRmNLMEqwh/cEubSvLDFexNmkESFatZqpndSP7GyLUnXHlJX2Nr0eTL+nVR85t7wC8PdPOAeop/VYmRDExOI2PQdyDmF+kK27u9ZLUof6PZ5g+Q8nAYnBKmS9H1J+D0UPGoyPpnQcgy5H45GDV7DuxVB15s3XgFsw6nggowffNP3Hko+pSVk5+BLcUbOldzw+vdezrR/YIGnhTPLDlkkq+q2HlnO0siGOSjR3+3qcfLmF6+yjpnfsugWWaKzWTZq6iNOmLh6l0r7n+2WZNsQKjlPPPhUWps0y1m7VkVJyE6pmezpLLADnQFhmvHW2YXyOk8uswnH8Uuok4hkE7WdgC1vbkWOQXILsVnI0STPdkmQCsPkdSkoNIzVlx1ObRiFk/xfeEfx6U6Sd8JXN3FI5jghdAeaG4AbdwK32im9rvgASgIJRHVTY9rwHfpdPnxUgjYPCuLL+nCmwDpkuvYKAdqfvJZaBZuA22xpgtC9UqA8hmWDP4FRqDF5AE66WiNB7rURAE3yGC42HrSVOKHTYtCp2u44cpR4d6K0YkRfbAAtwEDT+fsRV4OXOxcSLtYVG3kOsgskM55bllT32RvxLyl+G4tk5C8p7HfpKEvFUxHxfU+it5HBfFDxeSWOC0OwiKtSi+RxuL05IElybcq0VNv0qbajuWTKBmmcsGp90cEEf7X2D5YKW6PxKFsTJQkVkeOM1hTiVKWMz08OEr+jhm7/1two2q2M2y2JJoNVlMbn8AqOuEHqiQq0G7oy3cSJpG2xpzXAjMqVxqjI96CWdwBPjlRJ3DNaDg/vahpcBIZUY+L2ghVRqIan+7RaiQkSLDmd8CtRq48+6C/SXJBjTOOXaGLtR990+zYYSZdGfJprKCioaVdYLCXYWMdFAjYo5T1Jwr5q32ojfrhdEFw2YhEZzLLEzHbizrgSifEJDJejTXLiNs/e6QwTRaBT8YpZUSFfKO0eG1zf5VhgyonPFvTK0oG+O4SogCmqI/Qn2AUTGwSzmlHc+/MP4NE8R+5n0mbWLblgcgdqmBn53rsAcstYHlE9ffMznFBmPXps3V6DDa5lj1BaydA6nzTi6XwX8lu5eMSGs2DzOA1i+6oYXNHzT+2SUEpt/XM4R65pBF9xJmehtGK6DQjerZ/a039/5D/iQlv4x0t4M06KUYpfikOecI6EwDcPCBntaBUrHfpD5Actfd9KHH63B55bj3rp0Sw9eDbUp0J4lxSFAn5gZnVcNfNa3uilHRYpbMyLb0FYzt689zdEH7zzSrUPxyWStC3X9PJ0ncg6R7KtIUKIAnWFJIxVCcbpCAo8mQvmz+DCSQ2+b9AO7QF160t8Pp9llEcsZeJYXBhIbmhj8IF3Q1d9i2l39YhyvgrfoV+bTORwOmpD/CwAbu7KPx0kuTC12ifZtGrlY8PDM/YET+LMkzLqulpBqtZ1+F/wiSyN8jFwTMXBjcWDkp72qyoCvYxqpgQl0JK3XyonsiTWMlb2y/zsYJW5tjBKc1BxMW1fLsrzGA2AOL99SwIfdVP51aeTX2qpSumpX1GyZZr2EySUZcYifhr6jMVmrvYQagEo0NXYr1DG+A4JpMTrKEt076S7wf85r8vRZvY90rnEsT1ZYdeuLnLJNudqGZ02tmSB1gDtpL1Pxhr2/sSKXZ3cp2RyGnL/gLR9q3DVjZ1yeyqHq7WZn92UOBvkxTCfnoNIJtYmQrQfp7aYsbJoMYEqc3viIfR+08465VMIQFDw23DZ1XpAnRol44lXXTd7nO0+Sqao0S4puPTxg+PRwosMyJbkgjlyaFT7F4RhZDAktyqDk4lSnj1BmO1YVI7QDj8zftynuphYOvnCHwAm/uU11Tx+yDAchECUUOfbJy2VvLW2jMgySpSWPVQ7MNswLtw0+p0XyUNrUSxmuqPcEWXE2j2WtaQdyyWqdb4lI+jEFf5rRlPIETXOcOe7Cf8L7k0qZ30Dg7zYromX6OHPfYwmKQojI2PfYpcsi6thhPERVUQPwMqLKFv4iEclrTpHb6Pf0C/287XrsnNovAPsFjCQZzBsm8EvOWant+C0xnPidTmM8LsIvJzDlg08nm3tqkA0tuWj16W8Z5nN3jr62qsSbYqESezwb8Fa2kANaLue3jGmKZ3ntO2kGOzUqSEiWbZmhHwyrDYIvTzduFlXPLui4/XKX9ZSL96frSJgJmJ4YRc6mTIVyOFtsWGDSdTLj4Uop5PY2XRyFhbP3tyhI8rkeoMssQ+excHw2g1HmSheOZfkrW+g4rXaxxfA7kJtcWbWVY17xQPNWfpBLJs0ZK26l19MIr4ElFrjjov9RU6wCMo0n/pwIPL4cf5xXsLL9LsDuS9/BxyJWHOEnuwzWycYDjttZaJAQKBgvyv9ejhfCuk8xJS4Hm3rWqM9UjiBHhRqKBVOR/eBpJiMpEXT+Kkrzb57JGOosBc1hSCRiXuoMtH+jF0R1IUyKM4pjP5hwPgJ8hA3WBe/+eqyO13JlhAT7mgLo5CN3ynROhMKfSY45DEzEzFTLCIoZrdhbp7gy4dxu7FFbO2mcNdz9Wu9efIT45ee0P3Jyz6soAlXPSXYPpvXeRNrzYm74Y0bVVJrom2QEmIktYjGuEbDoBDef7bxClFEcJnV/cZL5ESIlx2JNawPR7otHZSNJiz68KiQviKOzEGV+edK5sYkJ+quWWAc6s5rWP+TiJhkY8XsMmQcoZTfvB
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"malware-sample\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181da-75d0-45b4-938a-47a2950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:58.000Z",
"modified": "2016-03-10T14:16:58.000Z",
"pattern": "[file:name = '80.exe' AND file:hashes.SHA1 = '8fcf0173a12206ff2e040b0e7427856718af6f24']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e181db-3370-4b20-bf82-4fbb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:16:59.000Z",
"modified": "2016-03-10T14:16:59.000Z",
"pattern": "[file:name = '80.exe' AND file:hashes.SHA256 = 'e0286bbf17ab1b5b9be197999cbf6862e233727e0dd4acddcb0e841eca6eb8cd']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:16:59Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e181ec-aef4-4572-8a32-4d6802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:17:16.000Z",
"modified": "2016-03-10T14:17:16.000Z",
"first_observed": "2016-03-10T14:17:16Z",
"last_observed": "2016-03-10T14:17:16Z",
"number_observed": 1,
"object_refs": [
"url--56e181ec-aef4-4572-8a32-4d6802de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e181ec-aef4-4572-8a32-4d6802de0b81",
"value": "https://www.virustotal.com/file/e0286bbf17ab1b5b9be197999cbf6862e233727e0dd4acddcb0e841eca6eb8cd/analysis/1457618606/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e181ed-7aa8-4c39-8ae4-448d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:17:17.000Z",
"modified": "2016-03-10T14:17:17.000Z",
"first_observed": "2016-03-10T14:17:17Z",
"last_observed": "2016-03-10T14:17:17Z",
"number_observed": 1,
"object_refs": [
"url--56e181ed-7aa8-4c39-8ae4-448d02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e181ed-7aa8-4c39-8ae4-448d02de0b81",
"value": "https://www.virustotal.com/file/1d64db20e038ba848f2720138122bf08e98cd647da33d2d448ae2586596c9ef6/analysis/1457617418/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--56e181ed-083c-404f-85b1-42ad02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:17:17.000Z",
"modified": "2016-03-10T14:17:17.000Z",
"first_observed": "2016-03-10T14:17:17Z",
"last_observed": "2016-03-10T14:17:17Z",
"number_observed": 1,
"object_refs": [
"url--56e181ed-083c-404f-85b1-42ad02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--56e181ed-083c-404f-85b1-42ad02de0b81",
"value": "https://www.virustotal.com/file/dab169740c3b4d6612f6614a50b2cf8ded42ddc5fada1830ffb3c8690dd6af89/analysis/1457619367/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e183c3-d5ec-4c1f-97c2-4ddb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:25:07.000Z",
"modified": "2016-03-10T14:25:07.000Z",
"description": "Automatically added (via 7t6f65g.exe|da08e56eea5592d172a2e77a866c1b95087c3873)",
"pattern": "[file:name = '7t6f65g.exe' AND file:hashes.MD5 = '7a40f11964136af4c6b798f9ca788dee']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:25:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e183c7-4d84-4180-9da3-42f3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-10T14:25:11.000Z",
"modified": "2016-03-10T14:25:11.000Z",
"description": "Automatically added (via 80.exe|8fcf0173a12206ff2e040b0e7427856718af6f24)",
"pattern": "[file:name = '80.exe' AND file:hashes.MD5 = '7095fbe91bfeef36785fd3eac3b874fc']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-10T14:25:11Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e2814d-6614-4f46-97f7-4351950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-11T08:26:53.000Z",
"modified": "2016-03-11T08:26:53.000Z",
"description": "Automatically added (via support.txt|9b2fb1ce362f3bd48fe8fa2e0d5d1dc025b2e2b0)",
"pattern": "[file:name = 'support.txt' AND file:hashes.MD5 = 'b554259bb0baf36c645d4f3bf4cf6004']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-11T08:26:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--56e28151-4bb8-4960-940f-4da7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-03-11T08:26:57.000Z",
"modified": "2016-03-11T08:26:57.000Z",
"description": "Automatically added (via 69.exe|4f39182bcce347788ca8f2b10b0f93bdefdecc78)",
"pattern": "[file:name = '69.exe' AND file:hashes.MD5 = '47becc218351868696361fd24a9926ba']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-03-11T08:26:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename|md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink