adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/58ceba55-4618-4c0d-8dc7-61b102de0b81.json

620 lines
28 KiB
JSON
Raw Normal View History

chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
{
"type": "bundle",
"id": "bundle--58ceba55-4618-4c0d-8dc7-61b102de0b81",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--58ceba55-4618-4c0d-8dc7-61b102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"name": "OSINT - RawPOS Malware Rides Again",
"published": "2017-03-19T17:10:13Z",
"object_refs": [
"observed-data--58ceba5f-2f1c-4552-9630-4bfc02de0b81",
"url--58ceba5f-2f1c-4552-9630-4bfc02de0b81",
"x-misp-attribute--58ceba8b-fdb4-481b-8d10-779502de0b81",
"indicator--58cebab8-d654-4b21-8eb6-4a5b02de0b81",
"indicator--58cebad4-418c-48a5-aaa6-779302de0b81",
"indicator--58cebad5-3ed8-4ef1-bd72-779302de0b81",
"indicator--58cebad6-0594-4e72-b49c-779302de0b81",
"indicator--58cebad7-0370-4bc4-88c6-779302de0b81",
"indicator--58cebad8-8580-4b24-aad8-779302de0b81",
"indicator--58cebb5b-4f98-4550-8ff3-489d02de0b81",
"indicator--58cebb5c-e694-4eb4-96b1-475502de0b81",
"observed-data--58cebb5d-583c-44d3-ae7e-4db802de0b81",
"url--58cebb5d-583c-44d3-ae7e-4db802de0b81",
"indicator--58cebb5d-6bb8-4279-8487-404202de0b81",
"indicator--58cebb5e-fd44-4f79-9c96-47ed02de0b81",
"observed-data--58cebb5f-8be8-4b56-9542-482702de0b81",
"url--58cebb5f-8be8-4b56-9542-482702de0b81",
"indicator--58cebb60-290c-46b2-840b-447602de0b81",
"indicator--58cebb61-de18-4e5d-b1ab-4ce502de0b81",
"observed-data--58cebb62-4e44-4cf0-8a4e-45d102de0b81",
"url--58cebb62-4e44-4cf0-8a4e-45d102de0b81",
"indicator--58cebb63-5c94-4bb4-806f-4e6a02de0b81",
"indicator--58cebb63-00c8-4d1f-a776-46a702de0b81",
"observed-data--58cebb64-a100-42db-82de-4e9302de0b81",
"url--58cebb64-a100-42db-82de-4e9302de0b81",
"indicator--58cebb65-08ec-4bb5-a386-4e4402de0b81",
"indicator--58cebb66-0e6c-4d85-995d-4cc402de0b81",
"observed-data--58cebb67-41b4-40d8-91fb-45f502de0b81",
"url--58cebb67-41b4-40d8-91fb-45f502de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"osint:source-type=\"blog-post\"",
"veris:asset:variety=\"U - POS terminal\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58ceba5f-2f1c-4552-9630-4bfc02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"first_observed": "2017-03-19T17:09:39Z",
"last_observed": "2017-03-19T17:09:39Z",
"number_observed": 1,
"object_refs": [
"url--58ceba5f-2f1c-4552-9630-4bfc02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58ceba5f-2f1c-4552-9630-4bfc02de0b81",
"value": "https://www.cylance.com/en_us/blog/rawpos-malware.html"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--58ceba8b-fdb4-481b-8d10-779502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "text",
"x_misp_value": "As part of a recent forensics investigation by the Cylance Consulting Services team, we uncovered some new RawPOS malware. This family of POS malware has been widely documented in operation since 2008. Numerous retail operations of various sizes have been compromised with this malware and its variants.\r\n\r\nRather than rehash old malware, our intent is to discuss \u00e2\u20ac\u02dcsignature fidelity\u00e2\u20ac\u2122 and explain through technical detail why poorly-written signatures give people a false sense of security. This \u00e2\u20ac\u02dcantivirus is dead\u00e2\u20ac\u2122 argument is often presented, but with little technical detail to highlight specifically why this is the case.\r\n\r\nIn our example below, the RawPOS variant went undetected for well over 30 days by a legacy antivirus (AV) vendor. By the time the vendor deployed custom DAT files, the only samples identified were in the quarantine directory of CylancePROTECT\u00c2\u00ae. Fortunately, this customer deployed CylancePROTECT in time and prevented any data exfiltration.\r\n\r\nAt the end of this post, we\u00e2\u20ac\u2122ll provide an updated yara file for identifying all variants of the RawPOS dumper, as well as some sha256 hashes of the new variant."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebab8-d654-4b21-8eb6-4a5b02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"pattern": "[rule RawPOS_dumper\r\n\r\n{\r\n\r\n meta:\r\n\r\n author = \"Cylance Inc.\"\r\n\r\n date = \"2017-01-24\"\r\n\r\n description = \"Used to detect all RawPOS RAM dumper(s)\"\r\n\r\n strings:\r\n\r\n $time_func = { 55 8b ec 81 c4 ?? ?? ?? ?? 53 56 57 8b ?? ?? 8b ?? ?? 6a 00 e8 ?? ?? ?? ?? 59 a3 ?? ?? ?? ?? 6a 00 e8 ?? ?? ?? ?? 59 3d ?? ?? ?? ?? 7e ?? 33 c0 e9 ?? ?? ?? ??}\r\n\r\n $enum_proc_func = { 55 8b ec 81 c4 ?? ?? ?? ?? 50 81 c4 ?? ?? ?? ?? 53 56 57 be c8 b9 42 00 8d ?? ?? ?? ?? ?? b9 41 00 00 00 f3 ?? 8d ?? ?? 50 68 a0 0f 00 00 8d ?? ?? ?? ?? ?? 52 e8 ?? ?? ?? ?? 85 c0 0f ?? ?? ?? ?? ??}\r\n\r\n $open_proc_func = { 8b f0 85 f6 0f ?? ?? ?? ?? ?? 8d ?? ?? 50 6a 04 8d ?? ?? 52 56 e8 ?? ?? ?? ?? 85 c0 74 ?? 68 04 01 00 00 8d ?? ?? ?? ?? ?? 51 ff ?? ?? 56 e8 ?? ?? ?? ?? 56 e8 ?? ?? ?? ??}\r\n\r\n condition:\r\n\r\n $enum_proc_func or $time_func or $open_proc_func\r\n\r\n}]",
"pattern_type": "yara",
chg: [gen] updated
2023-12-14 14:30:15 +00:00
"pattern_version": "2.1",
chg: [misp-stix] STIX 2.1 export added
2023-04-21 14:44:17 +00:00
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Artifacts dropped"
}
],
"labels": [
"misp:type=\"yara\"",
"misp:category=\"Artifacts dropped\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebad4-418c-48a5-aaa6-779302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"description": "New Variant",
"pattern": "[file:hashes.SHA256 = 'a2e720a2c538347144aee50ae85ebfdaf3fdffcfc731af732be5d3d82cd08b18']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebad5-3ed8-4ef1-bd72-779302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"description": "New Variant",
"pattern": "[file:hashes.SHA256 = 'fe8637ef9be609951aa218942d46a535ba771236668a49a84512b18b02e9fbee']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebad6-0594-4e72-b49c-779302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"description": "New Variant",
"pattern": "[file:hashes.SHA256 = '0ca08c10a79cddbb359354f59ba988e77892e16dce873b5ba8e20eb053af8a18']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebad7-0370-4bc4-88c6-779302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"description": "New Variant",
"pattern": "[file:hashes.SHA256 = '4bd1cc0a38117af7d268c29592ef754e51ce5674e26168c6bb613302f3c62fb8']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebad8-8580-4b24-aad8-779302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:39.000Z",
"modified": "2017-03-19T17:09:39.000Z",
"description": "New Variant",
"pattern": "[file:hashes.SHA256 = '967fcbc7abcb328afb1dbfd72d68636c478d7369e674d622799b8dfd66230112']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb5b-4f98-4550-8ff3-489d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:47.000Z",
"modified": "2017-03-19T17:09:47.000Z",
"description": "New Variant - Xchecked via VT: 967fcbc7abcb328afb1dbfd72d68636c478d7369e674d622799b8dfd66230112",
"pattern": "[file:hashes.SHA1 = '72b324a752f73c97296e379ff0a19352ab1bd333']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb5c-e694-4eb4-96b1-475502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:48.000Z",
"modified": "2017-03-19T17:09:48.000Z",
"description": "New Variant - Xchecked via VT: 967fcbc7abcb328afb1dbfd72d68636c478d7369e674d622799b8dfd66230112",
"pattern": "[file:hashes.MD5 = '92d6d8a64d06ce87b2711f3711ebcf9a']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58cebb5d-583c-44d3-ae7e-4db802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:49.000Z",
"modified": "2017-03-19T17:09:49.000Z",
"first_observed": "2017-03-19T17:09:49Z",
"last_observed": "2017-03-19T17:09:49Z",
"number_observed": 1,
"object_refs": [
"url--58cebb5d-583c-44d3-ae7e-4db802de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58cebb5d-583c-44d3-ae7e-4db802de0b81",
"value": "https://www.virustotal.com/file/967fcbc7abcb328afb1dbfd72d68636c478d7369e674d622799b8dfd66230112/analysis/1489006314/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb5d-6bb8-4279-8487-404202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:49.000Z",
"modified": "2017-03-19T17:09:49.000Z",
"description": "New Variant - Xchecked via VT: 4bd1cc0a38117af7d268c29592ef754e51ce5674e26168c6bb613302f3c62fb8",
"pattern": "[file:hashes.SHA1 = '3f02081e0b6a56e56bb946fbed42bc775a80613e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb5e-fd44-4f79-9c96-47ed02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:50.000Z",
"modified": "2017-03-19T17:09:50.000Z",
"description": "New Variant - Xchecked via VT: 4bd1cc0a38117af7d268c29592ef754e51ce5674e26168c6bb613302f3c62fb8",
"pattern": "[file:hashes.MD5 = '81bcb41c37fac427eda59ac121056b39']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:50Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58cebb5f-8be8-4b56-9542-482702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:51.000Z",
"modified": "2017-03-19T17:09:51.000Z",
"first_observed": "2017-03-19T17:09:51Z",
"last_observed": "2017-03-19T17:09:51Z",
"number_observed": 1,
"object_refs": [
"url--58cebb5f-8be8-4b56-9542-482702de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58cebb5f-8be8-4b56-9542-482702de0b81",
"value": "https://www.virustotal.com/file/4bd1cc0a38117af7d268c29592ef754e51ce5674e26168c6bb613302f3c62fb8/analysis/1484975136/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb60-290c-46b2-840b-447602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:52.000Z",
"modified": "2017-03-19T17:09:52.000Z",
"description": "New Variant - Xchecked via VT: 0ca08c10a79cddbb359354f59ba988e77892e16dce873b5ba8e20eb053af8a18",
"pattern": "[file:hashes.SHA1 = 'b5eead5b1c050f45127c4fe3ba63125f522b0a9c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb61-de18-4e5d-b1ab-4ce502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:53.000Z",
"modified": "2017-03-19T17:09:53.000Z",
"description": "New Variant - Xchecked via VT: 0ca08c10a79cddbb359354f59ba988e77892e16dce873b5ba8e20eb053af8a18",
"pattern": "[file:hashes.MD5 = '1a0cc9846a6d6499b4c264b49edc9115']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58cebb62-4e44-4cf0-8a4e-45d102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:54.000Z",
"modified": "2017-03-19T17:09:54.000Z",
"first_observed": "2017-03-19T17:09:54Z",
"last_observed": "2017-03-19T17:09:54Z",
"number_observed": 1,
"object_refs": [
"url--58cebb62-4e44-4cf0-8a4e-45d102de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58cebb62-4e44-4cf0-8a4e-45d102de0b81",
"value": "https://www.virustotal.com/file/0ca08c10a79cddbb359354f59ba988e77892e16dce873b5ba8e20eb053af8a18/analysis/1485335247/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb63-5c94-4bb4-806f-4e6a02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:55.000Z",
"modified": "2017-03-19T17:09:55.000Z",
"description": "New Variant - Xchecked via VT: fe8637ef9be609951aa218942d46a535ba771236668a49a84512b18b02e9fbee",
"pattern": "[file:hashes.SHA1 = 'c2f1f25f78cfaf1a9367d54f2af69b220a203cff']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb63-00c8-4d1f-a776-46a702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:55.000Z",
"modified": "2017-03-19T17:09:55.000Z",
"description": "New Variant - Xchecked via VT: fe8637ef9be609951aa218942d46a535ba771236668a49a84512b18b02e9fbee",
"pattern": "[file:hashes.MD5 = '8f9aa638e9bffd76b3764e726abfa9a6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58cebb64-a100-42db-82de-4e9302de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:56.000Z",
"modified": "2017-03-19T17:09:56.000Z",
"first_observed": "2017-03-19T17:09:56Z",
"last_observed": "2017-03-19T17:09:56Z",
"number_observed": 1,
"object_refs": [
"url--58cebb64-a100-42db-82de-4e9302de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58cebb64-a100-42db-82de-4e9302de0b81",
"value": "https://www.virustotal.com/file/fe8637ef9be609951aa218942d46a535ba771236668a49a84512b18b02e9fbee/analysis/1480241460/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb65-08ec-4bb5-a386-4e4402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:57.000Z",
"modified": "2017-03-19T17:09:57.000Z",
"description": "New Variant - Xchecked via VT: a2e720a2c538347144aee50ae85ebfdaf3fdffcfc731af732be5d3d82cd08b18",
"pattern": "[file:hashes.SHA1 = '787a7acba4aa7463d86a52b2d9afd95e568911ab']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:57Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--58cebb66-0e6c-4d85-995d-4cc402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:58.000Z",
"modified": "2017-03-19T17:09:58.000Z",
"description": "New Variant - Xchecked via VT: a2e720a2c538347144aee50ae85ebfdaf3fdffcfc731af732be5d3d82cd08b18",
"pattern": "[file:hashes.MD5 = '8673b3749bfbb9665d1c065333e184bb']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-03-19T17:09:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--58cebb67-41b4-40d8-91fb-45f502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-03-19T17:09:59.000Z",
"modified": "2017-03-19T17:09:59.000Z",
"first_observed": "2017-03-19T17:09:59Z",
"last_observed": "2017-03-19T17:09:59Z",
"number_observed": 1,
"object_refs": [
"url--58cebb67-41b4-40d8-91fb-45f502de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--58cebb67-41b4-40d8-91fb-45f502de0b81",
"value": "https://www.virustotal.com/file/a2e720a2c538347144aee50ae85ebfdaf3fdffcfc731af732be5d3d82cd08b18/analysis/1489006314/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue Copy permalink