769 lines
33 KiB
JSON
769 lines
33 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--57dff9a6-b4b0-4e79-9271-4a10950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:50.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:50.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--57dff9a6-b4b0-4e79-9271-4a10950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:50.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:50.000Z",
|
||
|
|
"name": "OSINT - Malicious Macros Add Sandbox Evasion Techniques to Distribute New Dridex",
|
||
|
|
"published": "2016-09-19T14:49:42Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--57dff9f5-8e50-47cc-a804-4513950d210f",
|
||
|
|
"url--57dff9f5-8e50-47cc-a804-4513950d210f",
|
||
|
|
"x-misp-attribute--57dffa06-a2e0-4cf0-a86e-4f4e950d210f",
|
||
|
|
"indicator--57dffa2d-edc8-443d-8ca8-4bdd950d210f",
|
||
|
|
"indicator--57dffa2e-0ca0-4410-bbdd-448c950d210f",
|
||
|
|
"indicator--57dffa2f-b5e8-41b5-a6ff-41d9950d210f",
|
||
|
|
"indicator--57dffa87-f8a8-452f-babe-4de0950d210f",
|
||
|
|
"indicator--57dffa88-2170-436e-938e-484a950d210f",
|
||
|
|
"indicator--57dffa88-7840-4208-8208-476b950d210f",
|
||
|
|
"indicator--57dffaaf-ff20-46d6-bb8f-49a8950d210f",
|
||
|
|
"indicator--57dffab0-c890-4dbb-9467-4351950d210f",
|
||
|
|
"indicator--57dffab0-39b8-4880-bcc9-472c950d210f",
|
||
|
|
"indicator--57dffad3-d5a8-4a68-880e-4a5d02de0b81",
|
||
|
|
"indicator--57dffad3-efe4-4839-a28d-4b6b02de0b81",
|
||
|
|
"observed-data--57dffad4-d364-4f79-b4e9-453602de0b81",
|
||
|
|
"url--57dffad4-d364-4f79-b4e9-453602de0b81",
|
||
|
|
"indicator--57dffad5-63a4-45ab-a6e0-4af502de0b81",
|
||
|
|
"indicator--57dffad5-2378-4608-b880-457b02de0b81",
|
||
|
|
"observed-data--57dffad6-a830-41f2-adb9-480302de0b81",
|
||
|
|
"url--57dffad6-a830-41f2-adb9-480302de0b81",
|
||
|
|
"indicator--57dffad7-5278-4962-91b7-43a002de0b81",
|
||
|
|
"indicator--57dffad7-ddb8-4af6-846a-457f02de0b81",
|
||
|
|
"observed-data--57dffad8-dae4-4425-bf3b-410202de0b81",
|
||
|
|
"url--57dffad8-dae4-4425-bf3b-410202de0b81",
|
||
|
|
"indicator--57dffad9-de4c-44b7-a374-405102de0b81",
|
||
|
|
"indicator--57dffad9-6b2c-43de-883a-4dbe02de0b81",
|
||
|
|
"observed-data--57dffada-9154-4c95-b067-43ea02de0b81",
|
||
|
|
"url--57dffada-9154-4c95-b067-43ea02de0b81",
|
||
|
|
"indicator--57dffadb-7b64-4794-89dc-452502de0b81",
|
||
|
|
"indicator--57dffadb-5cf0-490d-8b2b-4b6402de0b81",
|
||
|
|
"observed-data--57dffadc-f574-41e3-8413-489f02de0b81",
|
||
|
|
"url--57dffadc-f574-41e3-8413-489f02de0b81",
|
||
|
|
"indicator--57dffadd-6bf0-4f60-957a-422102de0b81",
|
||
|
|
"indicator--57dffadd-5800-46d8-a22a-472c02de0b81",
|
||
|
|
"observed-data--57dffade-be88-4afb-a678-46f702de0b81",
|
||
|
|
"url--57dffade-be88-4afb-a678-46f702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT"
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dff9f5-8e50-47cc-a804-4513950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:45:09.000Z",
|
||
|
|
"modified": "2016-09-19T14:45:09.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:45:09Z",
|
||
|
|
"last_observed": "2016-09-19T14:45:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dff9f5-8e50-47cc-a804-4513950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dff9f5-8e50-47cc-a804-4513950d210f",
|
||
|
|
"value": "https://www.proofpoint.com/us/threat-insight/post/malicious-macros-add-to-sandbox-evasion-techniques-to-distribute-new-dridex"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--57dffa06-a2e0-4cf0-a86e-4f4e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:45:26.000Z",
|
||
|
|
"modified": "2016-09-19T14:45:26.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "This week Proofpoint researchers observed several noteworthy changes in the macros used by an actor we refer to as TA530, who we previously examined in relation to large-scale personalized phishing campaigns [1] [2]. This new campaign included evasive macros, which, while not unusual for this group (earlier versions were analyzed by Mcafee [3] and Checkpoint [4]), demonstrated continued evolution in their latest iteration. Most notably their new macro looks up the public IP address of the client and does not download the payload if it finds that the IP address is associated with a security vendor, certain cloud services, or a sandbox environment.\r\n\r\nThis week, we observed TA530 using their evasive macros to deliver Nymaim, Ursnif, and Dridex 124. The Dridex payload with botnet ID 124 is a previously unseen sub-botnet which is targeting Swiss banking sites, while the Nymaim and Ursnif payloads targeted North America and Australia, respectively."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa2d-edc8-443d-8ca8-4bdd950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:46:05.000Z",
|
||
|
|
"modified": "2016-09-19T14:46:05.000Z",
|
||
|
|
"description": "Nymaim Document",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'a8ae681463b75470be8dc911f0cf7ca01a2eaea87005564263a5bbe38d652369']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:46:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa2e-0ca0-4410-bbdd-448c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:46:06.000Z",
|
||
|
|
"modified": "2016-09-19T14:46:06.000Z",
|
||
|
|
"description": "Ursnif Document",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f73fcbf4cf9a775d4d4abf53c13a0136a120d5a7e015942a7a43f686f266bf70']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:46:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa2f-b5e8-41b5-a6ff-41d9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:46:07.000Z",
|
||
|
|
"modified": "2016-09-19T14:46:07.000Z",
|
||
|
|
"description": "Dridex Document",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '72acb7dd6bea232c623367a4d3417d0ee7d412d3df5a0287d621716f5a69ab06']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:46:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa87-f8a8-452f-babe-4de0950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:47:35.000Z",
|
||
|
|
"modified": "2016-09-19T14:47:35.000Z",
|
||
|
|
"description": "Example Ursnif Download",
|
||
|
|
"pattern": "[url:value = 'http://britcart.com/britstar/office12.data']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:47:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa88-2170-436e-938e-484a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:47:36.000Z",
|
||
|
|
"modified": "2016-09-19T14:47:36.000Z",
|
||
|
|
"description": "Example Nymaim Download",
|
||
|
|
"pattern": "[url:value = 'http://arabtradenet.com/info/content.dat']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:47:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffa88-7840-4208-8208-476b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:47:36.000Z",
|
||
|
|
"modified": "2016-09-19T14:47:36.000Z",
|
||
|
|
"description": "Example Dridex Download",
|
||
|
|
"pattern": "[url:value = 'http://onehealthpublishing.com/image/office.gif']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:47:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffaaf-ff20-46d6-bb8f-49a8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:15.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:15.000Z",
|
||
|
|
"description": "Example Nymaim Payload",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f34589058db1a8cdb31c79eec88bd851cf3e2157501760f1c0263523d614d8f9']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffab0-c890-4dbb-9467-4351950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:16.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:16.000Z",
|
||
|
|
"description": "Example Ursnif Payload",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '6b588ff17412c4a8221521ab70d7d0230c339ed4c5c96c181e4010ba0007e879']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffab0-39b8-4880-bcc9-472c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:16.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:16.000Z",
|
||
|
|
"description": "Example Dridex Payload",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '97b1e8282d1ec8f82a83eb3d8a991f494e332e4059b1c9f0d53beda257e21629']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad3-d5a8-4a68-880e-4a5d02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:51.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:51.000Z",
|
||
|
|
"description": "Example Dridex Payload - Xchecked via VT: 97b1e8282d1ec8f82a83eb3d8a991f494e332e4059b1c9f0d53beda257e21629",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '50d2d8cceb257b074e37265da537cf493c805210']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad3-efe4-4839-a28d-4b6b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:51.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:51.000Z",
|
||
|
|
"description": "Example Dridex Payload - Xchecked via VT: 97b1e8282d1ec8f82a83eb3d8a991f494e332e4059b1c9f0d53beda257e21629",
|
||
|
|
"pattern": "[file:hashes.MD5 = '59b569b8875fd3847ae0308af85e3440']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:51Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffad4-d364-4f79-b4e9-453602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:52.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:52.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:48:52Z",
|
||
|
|
"last_observed": "2016-09-19T14:48:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffad4-d364-4f79-b4e9-453602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffad4-d364-4f79-b4e9-453602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/97b1e8282d1ec8f82a83eb3d8a991f494e332e4059b1c9f0d53beda257e21629/analysis/1465971238/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad5-63a4-45ab-a6e0-4af502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:53.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:53.000Z",
|
||
|
|
"description": "Example Ursnif Payload - Xchecked via VT: 6b588ff17412c4a8221521ab70d7d0230c339ed4c5c96c181e4010ba0007e879",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '61996a309d84daf441cd7a3e71ed45c8fe210824']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad5-2378-4608-b880-457b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:53.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:53.000Z",
|
||
|
|
"description": "Example Ursnif Payload - Xchecked via VT: 6b588ff17412c4a8221521ab70d7d0230c339ed4c5c96c181e4010ba0007e879",
|
||
|
|
"pattern": "[file:hashes.MD5 = '86a50ac34b6e18b5bec0a24a1b4f12d3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffad6-a830-41f2-adb9-480302de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:54.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:54.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:48:54Z",
|
||
|
|
"last_observed": "2016-09-19T14:48:54Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffad6-a830-41f2-adb9-480302de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffad6-a830-41f2-adb9-480302de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/6b588ff17412c4a8221521ab70d7d0230c339ed4c5c96c181e4010ba0007e879/analysis/1473668183/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad7-5278-4962-91b7-43a002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:55.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:55.000Z",
|
||
|
|
"description": "Example Nymaim Payload - Xchecked via VT: f34589058db1a8cdb31c79eec88bd851cf3e2157501760f1c0263523d614d8f9",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c28bec7ce1d0bcfd1a007cefe086571d5d49b975']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad7-ddb8-4af6-846a-457f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:55.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:55.000Z",
|
||
|
|
"description": "Example Nymaim Payload - Xchecked via VT: f34589058db1a8cdb31c79eec88bd851cf3e2157501760f1c0263523d614d8f9",
|
||
|
|
"pattern": "[file:hashes.MD5 = '12abc10d3c37841f4f4f7e193b045f6b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffad8-dae4-4425-bf3b-410202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:56.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:56.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:48:56Z",
|
||
|
|
"last_observed": "2016-09-19T14:48:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffad8-dae4-4425-bf3b-410202de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffad8-dae4-4425-bf3b-410202de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f34589058db1a8cdb31c79eec88bd851cf3e2157501760f1c0263523d614d8f9/analysis/1465970739/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad9-de4c-44b7-a374-405102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:57.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:57.000Z",
|
||
|
|
"description": "Dridex Document - Xchecked via VT: 72acb7dd6bea232c623367a4d3417d0ee7d412d3df5a0287d621716f5a69ab06",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '27c3ff564efbf5db343feba688236c180846b61b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffad9-6b2c-43de-883a-4dbe02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:57.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:57.000Z",
|
||
|
|
"description": "Dridex Document - Xchecked via VT: 72acb7dd6bea232c623367a4d3417d0ee7d412d3df5a0287d621716f5a69ab06",
|
||
|
|
"pattern": "[file:hashes.MD5 = '64d133b98ab00c9f5409e4ab29a70250']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffada-9154-4c95-b067-43ea02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:58.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:58.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:48:58Z",
|
||
|
|
"last_observed": "2016-09-19T14:48:58Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffada-9154-4c95-b067-43ea02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffada-9154-4c95-b067-43ea02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/72acb7dd6bea232c623367a4d3417d0ee7d412d3df5a0287d621716f5a69ab06/analysis/1466780189/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffadb-7b64-4794-89dc-452502de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:59.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:59.000Z",
|
||
|
|
"description": "Ursnif Document - Xchecked via VT: f73fcbf4cf9a775d4d4abf53c13a0136a120d5a7e015942a7a43f686f266bf70",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'cfb624f1b220b96e51214a58a29e596334cf975d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffadb-5cf0-490d-8b2b-4b6402de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:48:59.000Z",
|
||
|
|
"modified": "2016-09-19T14:48:59.000Z",
|
||
|
|
"description": "Ursnif Document - Xchecked via VT: f73fcbf4cf9a775d4d4abf53c13a0136a120d5a7e015942a7a43f686f266bf70",
|
||
|
|
"pattern": "[file:hashes.MD5 = '89968ce9689ffcf42cd5e8b1702ad6a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:48:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffadc-f574-41e3-8413-489f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:49:00.000Z",
|
||
|
|
"modified": "2016-09-19T14:49:00.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:49:00Z",
|
||
|
|
"last_observed": "2016-09-19T14:49:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffadc-f574-41e3-8413-489f02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffadc-f574-41e3-8413-489f02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/f73fcbf4cf9a775d4d4abf53c13a0136a120d5a7e015942a7a43f686f266bf70/analysis/1465721182/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffadd-6bf0-4f60-957a-422102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:49:01.000Z",
|
||
|
|
"modified": "2016-09-19T14:49:01.000Z",
|
||
|
|
"description": "Nymaim Document - Xchecked via VT: a8ae681463b75470be8dc911f0cf7ca01a2eaea87005564263a5bbe38d652369",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f5249c827757e4ef4bc107e7ca0e8e5b3e361bdc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:49:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--57dffadd-5800-46d8-a22a-472c02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:49:01.000Z",
|
||
|
|
"modified": "2016-09-19T14:49:01.000Z",
|
||
|
|
"description": "Nymaim Document - Xchecked via VT: a8ae681463b75470be8dc911f0cf7ca01a2eaea87005564263a5bbe38d652369",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ad9c255868ab55652555e47d8985ea2f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-09-19T14:49:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--57dffade-be88-4afb-a678-46f702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-09-19T14:49:02.000Z",
|
||
|
|
"modified": "2016-09-19T14:49:02.000Z",
|
||
|
|
"first_observed": "2016-09-19T14:49:02Z",
|
||
|
|
"last_observed": "2016-09-19T14:49:02Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--57dffade-be88-4afb-a678-46f702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--57dffade-be88-4afb-a678-46f702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/a8ae681463b75470be8dc911f0cf7ca01a2eaea87005564263a5bbe38d652369/analysis/1465720444/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|