535 lines
23 KiB
JSON
535 lines
23 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--582176fc-def0-44a8-b435-4f66950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:54.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:54.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--582176fc-def0-44a8-b435-4f66950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:54.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:54.000Z",
|
||
|
|
"name": "OSINT - Exaspy \u00e2\u20ac\u201c Commodity Android Spyware Targeting High-level Executives",
|
||
|
|
"published": "2016-11-08T07:01:27Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5821770c-ac54-4173-992f-4d01950d210f",
|
||
|
|
"url--5821770c-ac54-4173-992f-4d01950d210f",
|
||
|
|
"x-misp-attribute--58217727-65a8-4dc0-b579-48c1950d210f",
|
||
|
|
"indicator--58217746-abb4-4d54-ad37-4df3950d210f",
|
||
|
|
"indicator--58217746-7bcc-4114-8ffb-41a1950d210f",
|
||
|
|
"indicator--58217746-e3c4-4a41-930f-4d9c950d210f",
|
||
|
|
"indicator--58217746-4598-40a4-8287-4fb6950d210f",
|
||
|
|
"indicator--5821775c-cda4-4aa0-aa41-4d1d950d210f",
|
||
|
|
"x-misp-attribute--58217777-9a6c-43f6-8331-4551950d210f",
|
||
|
|
"indicator--58217826-0f64-4c14-88ac-453f02de0b81",
|
||
|
|
"indicator--58217827-8734-4c43-a579-440602de0b81",
|
||
|
|
"observed-data--58217827-14d0-43e8-bdaf-467002de0b81",
|
||
|
|
"url--58217827-14d0-43e8-bdaf-467002de0b81",
|
||
|
|
"indicator--58217827-a93c-41e4-849a-4eef02de0b81",
|
||
|
|
"indicator--58217827-4c0c-41be-8414-4af602de0b81",
|
||
|
|
"observed-data--58217827-d514-4f1a-8d38-4f9602de0b81",
|
||
|
|
"url--58217827-d514-4f1a-8d38-4f9602de0b81",
|
||
|
|
"indicator--58217828-a5f0-40ee-b9f5-49d702de0b81",
|
||
|
|
"indicator--58217828-039c-4de5-a02c-41a802de0b81",
|
||
|
|
"observed-data--58217828-a050-4c4c-a8c2-4fd102de0b81",
|
||
|
|
"url--58217828-a050-4c4c-a8c2-4fd102de0b81",
|
||
|
|
"indicator--58217828-45ec-4cb9-a1bc-4dc202de0b81",
|
||
|
|
"indicator--58217829-ae18-45af-ac90-44d602de0b81",
|
||
|
|
"observed-data--58217829-9d78-4f84-9fb1-431702de0b81",
|
||
|
|
"url--58217829-9d78-4f84-9fb1-431702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ms-caro-malware:malware-platform=\"AndroidOS\"",
|
||
|
|
"enisa:nefarious-activity-abuse=\"mobile-malware\"",
|
||
|
|
"circl:incident-classification=\"malware\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5821770c-ac54-4173-992f-4d01950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:56:12.000Z",
|
||
|
|
"modified": "2016-11-08T06:56:12.000Z",
|
||
|
|
"first_observed": "2016-11-08T06:56:12Z",
|
||
|
|
"last_observed": "2016-11-08T06:56:12Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5821770c-ac54-4173-992f-4d01950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5821770c-ac54-4173-992f-4d01950d210f",
|
||
|
|
"value": "https://www.skycure.com/blog/exaspy-commodity-android-spyware-targeting-high-level-executives/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--58217727-65a8-4dc0-b579-48c1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:56:39.000Z",
|
||
|
|
"modified": "2016-11-08T06:56:39.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "Early September, Skycure Research Labs detected a fake app within one of our customer\u00e2\u20ac\u2122s organizations, identified through our crowd-sourced intelligence policies (whereby anyone running the Skycure mobile app acts as a threat detecting sensor). This customer is a global technology company, which deployed Skycure\u00e2\u20ac\u2122s Enterprise Mobile Threat Defense solution for all iOS and Android devices within their organization. This incident happened on an Android 6.0.1 device, owned by one of the company\u00e2\u20ac\u2122s Vice Presidents. The customer has given us approval to share some of the details about the Spyware app that Skycure discovered."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217746-abb4-4d54-ad37-4df3950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:10.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:10.000Z",
|
||
|
|
"description": "com.android.protect",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'c4826138e07636af1eeb6008e580704575ec1bc7']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T06:57:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217746-7bcc-4114-8ffb-41a1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:10.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:10.000Z",
|
||
|
|
"description": "com.android.protect",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '4bf89c3bf4fb88ad6456fe5642868272e4e2f364']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T06:57:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217746-e3c4-4a41-930f-4d9c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:10.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:10.000Z",
|
||
|
|
"description": "com.android.protect",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '9725c1bf9483ff41f226f22bd331387c187e9179']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T06:57:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217746-4598-40a4-8287-4fb6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:10.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:10.000Z",
|
||
|
|
"description": "com.android.protect",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'f1fbebc2beafe0467ee00e69b3f75719cdbbd693']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T06:57:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5821775c-cda4-4aa0-aa41-4d1d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:32.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:32.000Z",
|
||
|
|
"pattern": "[x509-certificate:hashes.SHA1 = 'c5c82ecf20af94e0f2a19078b790d8434ccedb59']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T06:57:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"x509-fingerprint-sha1\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--58217777-9a6c-43f6-8331-4551950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T06:57:59.000Z",
|
||
|
|
"modified": "2016-11-08T06:57:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"pattern-in-file\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Artifacts dropped",
|
||
|
|
"x_misp_type": "pattern-in-file",
|
||
|
|
"x_misp_value": "Subject: /O=Exaspy/OU=Exaspy/CN=Exaspy"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217826-0f64-4c14-88ac-453f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:54.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:54.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: f1fbebc2beafe0467ee00e69b3f75719cdbbd693",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'fee19f19638b0f66ba5cb32c229c4cb62e197cc10ce061666c543a7d0bdf784a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217827-8734-4c43-a579-440602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:55.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:55.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: f1fbebc2beafe0467ee00e69b3f75719cdbbd693",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7fa9b921f9cf78f9503fa808c44b3f0e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58217827-14d0-43e8-bdaf-467002de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:55.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:55.000Z",
|
||
|
|
"first_observed": "2016-11-08T07:00:55Z",
|
||
|
|
"last_observed": "2016-11-08T07:00:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58217827-14d0-43e8-bdaf-467002de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58217827-14d0-43e8-bdaf-467002de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/fee19f19638b0f66ba5cb32c229c4cb62e197cc10ce061666c543a7d0bdf784a/analysis/1478545205/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217827-a93c-41e4-849a-4eef02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:55.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:55.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: 9725c1bf9483ff41f226f22bd331387c187e9179",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b9d37ce509d37ade6cb064ff41e6de99fcf686fcea70ae355f76018896eaf508']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217827-4c0c-41be-8414-4af602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:55.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:55.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: 9725c1bf9483ff41f226f22bd331387c187e9179",
|
||
|
|
"pattern": "[file:hashes.MD5 = '204f3840d8e641642ddb682827c07e66']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58217827-d514-4f1a-8d38-4f9602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:55.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:55.000Z",
|
||
|
|
"first_observed": "2016-11-08T07:00:55Z",
|
||
|
|
"last_observed": "2016-11-08T07:00:55Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58217827-d514-4f1a-8d38-4f9602de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58217827-d514-4f1a-8d38-4f9602de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/b9d37ce509d37ade6cb064ff41e6de99fcf686fcea70ae355f76018896eaf508/analysis/1478208415/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217828-a5f0-40ee-b9f5-49d702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:56.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:56.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: 4bf89c3bf4fb88ad6456fe5642868272e4e2f364",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'cd021fdf7e00a76a13e51f8608a687208be3eb68139627a1986bb0c4009dc58c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217828-039c-4de5-a02c-41a802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:56.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:56.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: 4bf89c3bf4fb88ad6456fe5642868272e4e2f364",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b7a6e575fdd46ae65b0b2a8392811919']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58217828-a050-4c4c-a8c2-4fd102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:56.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:56.000Z",
|
||
|
|
"first_observed": "2016-11-08T07:00:56Z",
|
||
|
|
"last_observed": "2016-11-08T07:00:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58217828-a050-4c4c-a8c2-4fd102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58217828-a050-4c4c-a8c2-4fd102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/cd021fdf7e00a76a13e51f8608a687208be3eb68139627a1986bb0c4009dc58c/analysis/1478547307/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217828-45ec-4cb9-a1bc-4dc202de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:56.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:56.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: c4826138e07636af1eeb6008e580704575ec1bc7",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0b8eb5b517a5a841a888d583e0a187983c6028b92634116cfc9bf79d165ac988']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:56Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--58217829-ae18-45af-ac90-44d602de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:57.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:57.000Z",
|
||
|
|
"description": "com.android.protect - Xchecked via VT: c4826138e07636af1eeb6008e580704575ec1bc7",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c4c3522074b9808d10e2828d41aafdda']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2016-11-08T07:00:57Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload installation"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload installation\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--58217829-9d78-4f84-9fb1-431702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2016-11-08T07:00:57.000Z",
|
||
|
|
"modified": "2016-11-08T07:00:57.000Z",
|
||
|
|
"first_observed": "2016-11-08T07:00:57Z",
|
||
|
|
"last_observed": "2016-11-08T07:00:57Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--58217829-9d78-4f84-9fb1-431702de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--58217829-9d78-4f84-9fb1-431702de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0b8eb5b517a5a841a888d583e0a187983c6028b92634116cfc9bf79d165ac988/analysis/1478534532/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|