1442 lines
57 KiB
JSON
1442 lines
57 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59c56225-d8d0-4c83-bfc5-403e950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T11:38:16.000Z",
|
||
|
|
"modified": "2017-09-25T11:38:16.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59c56225-d8d0-4c83-bfc5-403e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-25T11:38:16.000Z",
|
||
|
|
"modified": "2017-09-25T11:38:16.000Z",
|
||
|
|
"name": "M2M - Locky 2017-09-22 : Affid=3, offline, \".ykcol\" : \"Your Invoice # 123456\" - \"Invoice_file_654321.7z\"",
|
||
|
|
"published": "2017-09-25T11:38:26Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--59c56226-f418-4427-905e-4f3c950d210f",
|
||
|
|
"indicator--59c56227-39b8-43fe-9832-445d950d210f",
|
||
|
|
"indicator--59c56227-239c-4f7b-9a1f-45df950d210f",
|
||
|
|
"observed-data--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"network-traffic--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"ipv4-addr--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"indicator--59c56229-f174-4117-a3ca-e0c7950d210f",
|
||
|
|
"indicator--59c56229-43d8-4573-8faf-4dd6950d210f",
|
||
|
|
"observed-data--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"network-traffic--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"ipv4-addr--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"indicator--59c56229-bb90-47dc-8dd4-4f84950d210f",
|
||
|
|
"indicator--59c5622a-9ccc-4e0f-8694-4f90950d210f",
|
||
|
|
"observed-data--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"network-traffic--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"ipv4-addr--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"indicator--59c5622a-210c-47f0-869f-d2d7950d210f",
|
||
|
|
"indicator--59c5622a-a428-4a63-baef-4454950d210f",
|
||
|
|
"observed-data--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"network-traffic--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"ipv4-addr--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"indicator--59c5622b-b9f4-4639-ab31-4340950d210f",
|
||
|
|
"indicator--59c5622b-d9d0-4459-a778-4153950d210f",
|
||
|
|
"observed-data--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"network-traffic--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"ipv4-addr--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"indicator--59c5622c-f4c8-4a6b-8b33-df79950d210f",
|
||
|
|
"indicator--59c5622c-fa18-48a2-b8c7-4e7d950d210f",
|
||
|
|
"observed-data--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"network-traffic--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"ipv4-addr--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"indicator--59c5622d-1bcc-4526-bf63-4088950d210f",
|
||
|
|
"indicator--59c5622d-b72c-44b9-84bc-40c4950d210f",
|
||
|
|
"observed-data--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"network-traffic--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"ipv4-addr--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"indicator--59c5622e-e6c8-4467-9f5a-e0c7950d210f",
|
||
|
|
"indicator--59c5622e-c598-4598-9e6c-4de5950d210f",
|
||
|
|
"observed-data--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"network-traffic--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"ipv4-addr--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"indicator--59c5622e-0494-49a2-afe6-44c2950d210f",
|
||
|
|
"indicator--59c5622e-6b3c-4427-9fad-1330950d210f",
|
||
|
|
"observed-data--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"network-traffic--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"ipv4-addr--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"indicator--59c5622f-4aa4-48e7-a8d8-df79950d210f",
|
||
|
|
"indicator--59c56230-fa1c-4541-ba1d-4a55950d210f",
|
||
|
|
"indicator--59c56231-62f4-4342-b72c-4d31950d210f",
|
||
|
|
"indicator--59c56231-df80-41a4-81a0-4ae9950d210f",
|
||
|
|
"observed-data--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"network-traffic--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"ipv4-addr--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"indicator--59c56231-6e48-4f48-8bcb-44fb950d210f",
|
||
|
|
"indicator--59c56232-b36c-445e-aa0c-e0c7950d210f",
|
||
|
|
"observed-data--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"network-traffic--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"ipv4-addr--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"indicator--59c56232-987c-46ab-ae03-7461950d210f",
|
||
|
|
"indicator--59c56232-e20c-4566-9e07-1330950d210f",
|
||
|
|
"observed-data--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"network-traffic--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"ipv4-addr--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"indicator--59c56233-ccb0-44ca-b708-420d950d210f",
|
||
|
|
"indicator--59c56233-c0f8-4c82-ac9b-42ce950d210f",
|
||
|
|
"observed-data--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"network-traffic--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"ipv4-addr--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"indicator--59c56234-811c-425b-b09f-42eb950d210f",
|
||
|
|
"indicator--59c56234-1e38-4e98-b968-48fe950d210f",
|
||
|
|
"observed-data--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"network-traffic--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"ipv4-addr--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"indicator--59c56234-7c9c-440c-988c-1330950d210f",
|
||
|
|
"indicator--59c56235-af4c-4d68-9b3c-46e4950d210f",
|
||
|
|
"observed-data--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"network-traffic--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"ipv4-addr--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"indicator--59c56235-9e18-470e-9ed1-4238950d210f",
|
||
|
|
"indicator--59c56235-7a90-4348-b276-482b950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
||
|
|
"misp-galaxy:ransomware=\"Locky\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56226-f418-4427-905e-4f3c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:02.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:02.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a43815fa99ead81bf7b9eea1f782166b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Artifacts dropped"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Artifacts dropped\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56227-39b8-43fe-9832-445d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:03.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:03.000Z",
|
||
|
|
"pattern": "[url:value = 'http://aerotransfer.cl/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56227-239c-4f7b-9a1f-45df950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:03.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:03.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'aerotransfer.cl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:04.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:04.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:04Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:04Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"ipv4-addr--59c56228-6478-491f-9e8b-4158950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56228-6478-491f-9e8b-4158950d210f",
|
||
|
|
"value": "131.72.237.171"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56229-f174-4117-a3ca-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:05.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:05.000Z",
|
||
|
|
"pattern": "[url:value = 'http://aldridgestudios.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56229-43d8-4573-8faf-4dd6950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:05.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:05.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'aldridgestudios.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:05.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:05.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:05Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"ipv4-addr--59c56229-6210-4fc2-82a3-7461950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56229-6210-4fc2-82a3-7461950d210f",
|
||
|
|
"value": "69.64.38.155"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56229-bb90-47dc-8dd4-4f84950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:05.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:05.000Z",
|
||
|
|
"pattern": "[url:value = 'http://alibristolphotography.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:05Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622a-9ccc-4e0f-8694-4f90950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:06.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:06.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'alibristolphotography.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:06.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:06.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:06Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:06Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"ipv4-addr--59c5622a-8060-4cfb-8efd-4f81950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622a-8060-4cfb-8efd-4f81950d210f",
|
||
|
|
"value": "72.32.177.50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622a-210c-47f0-869f-d2d7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:06.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:06.000Z",
|
||
|
|
"pattern": "[url:value = 'http://allesandradesigns.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622a-a428-4a63-baef-4454950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:06.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:06.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'allesandradesigns.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:07.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:07.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:07Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:07Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"ipv4-addr--59c5622b-bf24-45c6-98de-e0d9950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622b-bf24-45c6-98de-e0d9950d210f",
|
||
|
|
"value": "173.203.199.105"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622b-b9f4-4639-ab31-4340950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:07.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:07.000Z",
|
||
|
|
"pattern": "[url:value = 'http://amatuermatch.org/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622b-d9d0-4459-a778-4153950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:07.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:07.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'amatuermatch.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:07Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:08.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:08.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:08Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:08Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"ipv4-addr--59c5622c-f068-4737-a989-46e8950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622c-f068-4737-a989-46e8950d210f",
|
||
|
|
"value": "64.50.172.171"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622c-f4c8-4a6b-8b33-df79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:08.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:08.000Z",
|
||
|
|
"pattern": "[url:value = 'http://amesatarragona.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622c-fa18-48a2-b8c7-4e7d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:08.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:08.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'amesatarragona.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:08Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:09.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:09.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:09Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"ipv4-addr--59c5622d-c438-43a5-99e9-434c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622d-c438-43a5-99e9-434c950d210f",
|
||
|
|
"value": "87.98.227.9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622d-1bcc-4526-bf63-4088950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:09.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:09.000Z",
|
||
|
|
"pattern": "[url:value = 'http://ammannati.it/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622d-b72c-44b9-84bc-40c4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:09.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:09.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ammannati.it']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:09Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:09.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:09.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:09Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:09Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"ipv4-addr--59c5622d-edb4-4f61-8710-45df950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622d-edb4-4f61-8710-45df950d210f",
|
||
|
|
"value": "185.58.7.11"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622e-e6c8-4467-9f5a-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:10.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:10.000Z",
|
||
|
|
"pattern": "[url:value = 'http://anderlaw.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622e-c598-4598-9e6c-4de5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:10.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:10.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'anderlaw.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:10.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:10.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:10Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:10Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"ipv4-addr--59c5622e-59f4-4ca5-80ad-7461950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622e-59f4-4ca5-80ad-7461950d210f",
|
||
|
|
"value": "98.124.251.69"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622e-0494-49a2-afe6-44c2950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:10.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:10.000Z",
|
||
|
|
"pattern": "[url:value = 'http://andresarlemijn.nl/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622e-6b3c-4427-9fad-1330950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:10.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:10.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'andresarlemijn.nl']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:11.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:11.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:11Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:11Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"ipv4-addr--59c5622f-4378-4fe0-a878-4336950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c5622f-4378-4fe0-a878-4336950d210f",
|
||
|
|
"value": "195.60.215.74"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c5622f-4aa4-48e7-a8d8-df79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:11.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:11.000Z",
|
||
|
|
"pattern": "[url:value = 'http://andza.lv/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56230-fa1c-4541-ba1d-4a55950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:12.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:12.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'andza.lv']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56231-62f4-4342-b72c-4d31950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:13.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:13.000Z",
|
||
|
|
"pattern": "[url:value = 'http://animal-naturals.net/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56231-df80-41a4-81a0-4ae9950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:13.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:13.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'animal-naturals.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:13.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:13.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:13Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:13Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"ipv4-addr--59c56231-6df4-4fca-aa99-409a950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56231-6df4-4fca-aa99-409a950d210f",
|
||
|
|
"value": "62.212.154.121"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56231-6e48-4f48-8bcb-44fb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:13.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:13.000Z",
|
||
|
|
"pattern": "[url:value = 'http://antwerpiastamps.be/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56232-b36c-445e-aa0c-e0c7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:14.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:14.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'antwerpiastamps.be']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:14.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:14.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:14Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:14Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"ipv4-addr--59c56232-50a8-49cd-a9d9-4ee8950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56232-50a8-49cd-a9d9-4ee8950d210f",
|
||
|
|
"value": "77.241.93.243"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56232-987c-46ab-ae03-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:14.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:14.000Z",
|
||
|
|
"pattern": "[url:value = 'http://appartement-sailer.at/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56232-e20c-4566-9e07-1330950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:14.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:14.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'appartement-sailer.at']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:15.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:15.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:15Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"ipv4-addr--59c56233-b37c-480f-9d16-406c950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56233-b37c-480f-9d16-406c950d210f",
|
||
|
|
"value": "83.175.70.7"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56233-ccb0-44ca-b708-420d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:15.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:15.000Z",
|
||
|
|
"pattern": "[url:value = 'http://arc-conduite.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56233-c0f8-4c82-ac9b-42ce950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:15.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:15.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'arc-conduite.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:15Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:15.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:15.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:15Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:15Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"ipv4-addr--59c56233-fb9c-4fe7-88c2-4de5950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56233-fb9c-4fe7-88c2-4de5950d210f",
|
||
|
|
"value": "193.227.248.241"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56234-811c-425b-b09f-42eb950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:16.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:16.000Z",
|
||
|
|
"pattern": "[url:value = 'http://ar-inversiones.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56234-1e38-4e98-b968-48fe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:16.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:16.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ar-inversiones.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:16.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:16.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:16Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:16Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"ipv4-addr--59c56234-a8d0-4f65-9f7c-7461950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56234-a8d0-4f65-9f7c-7461950d210f",
|
||
|
|
"value": "37.247.122.52"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56234-7c9c-440c-988c-1330950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:16.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:16.000Z",
|
||
|
|
"pattern": "[url:value = 'http://arktupala.com/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:16Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56235-af4c-4d68-9b3c-46e4950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:17.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:17.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'arktupala.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:17.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:17.000Z",
|
||
|
|
"first_observed": "2017-09-22T19:19:17Z",
|
||
|
|
"last_observed": "2017-09-22T19:19:17Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"ipv4-addr--59c56235-e35c-40af-9207-df79950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--59c56235-e35c-40af-9207-df79950d210f",
|
||
|
|
"value": "85.17.24.201"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56235-9e18-470e-9ed1-4238950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:17.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:17.000Z",
|
||
|
|
"pattern": "[url:value = 'http://ideathlike.net/p66/jhdsgvc74']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59c56235-7a90-4348-b276-482b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-09-22T19:19:17.000Z",
|
||
|
|
"modified": "2017-09-22T19:19:17.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'ideathlike.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-09-22T19:19:17Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|