535 lines
23 KiB
JSON
535 lines
23 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--59d4e235-c71c-4d0e-8ba3-920c950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--59d4e235-c71c-4d0e-8ba3-920c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"name": "OSINT - Malicious Chrome Extensions Stealing Roblox In-Game Currency, Sending Cookies via Discord",
|
||
|
|
"published": "2017-10-04T17:28:38Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--59d4e258-5a54-41aa-868e-ef0b950d210f",
|
||
|
|
"url--59d4e258-5a54-41aa-868e-ef0b950d210f",
|
||
|
|
"x-misp-attribute--59d4e404-be44-4e16-b6c3-b83b950d210f",
|
||
|
|
"indicator--59d4e425-b328-4b76-b5e9-3f50950d210f",
|
||
|
|
"indicator--59d4e425-1144-47c5-8833-3f50950d210f",
|
||
|
|
"indicator--59d4e425-0c38-4ed1-bd79-3f50950d210f",
|
||
|
|
"indicator--59d4e425-c98c-4588-8d41-3f50950d210f",
|
||
|
|
"indicator--59d4e425-9594-474f-8ee1-3f50950d210f",
|
||
|
|
"indicator--59d4e425-836c-4050-95ca-3f50950d210f",
|
||
|
|
"indicator--59d4e425-63fc-4e16-bc14-3f50950d210f",
|
||
|
|
"indicator--59d4e425-07ec-4e8b-960b-3f50950d210f",
|
||
|
|
"indicator--59d4e425-5918-432e-a551-3f50950d210f",
|
||
|
|
"indicator--59d51a40-78a4-47e6-8d7d-45d702de0b81",
|
||
|
|
"indicator--59d51a40-f80c-419e-b758-4b6802de0b81",
|
||
|
|
"observed-data--59d51a40-6988-4a79-8984-481b02de0b81",
|
||
|
|
"url--59d51a40-6988-4a79-8984-481b02de0b81",
|
||
|
|
"indicator--59d51a40-bd94-4247-bdc7-470f02de0b81",
|
||
|
|
"indicator--59d51a40-5020-4fac-b79f-484e02de0b81",
|
||
|
|
"observed-data--59d51a40-c028-406c-a257-45a102de0b81",
|
||
|
|
"url--59d51a40-c028-406c-a257-45a102de0b81",
|
||
|
|
"indicator--59d51a40-caa0-4640-8256-4c1702de0b81",
|
||
|
|
"indicator--59d51a40-2a00-40e0-9edb-469902de0b81",
|
||
|
|
"observed-data--59d51a41-d934-4f2c-8e76-44d802de0b81",
|
||
|
|
"url--59d51a41-d934-4f2c-8e76-44d802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"type:OSINT",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59d4e258-5a54-41aa-868e-ef0b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"first_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"last_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59d4e258-5a54-41aa-868e-ef0b950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59d4e258-5a54-41aa-868e-ef0b950d210f",
|
||
|
|
"value": "http://blog.trendmicro.com/trendlabs-security-intelligence/malicous-chrome-extensions-stealing-roblox-game-currency-sending-cookies-via-discord/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--59d4e404-be44-4e16-b6c3-b83b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"comment\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "comment",
|
||
|
|
"x_misp_value": "We recently discussed how cyber criminals are using the popular voice/chat client Discord to steal cookies from the running Roblox process on a Windows PC. Since then, we\u00e2\u20ac\u2122ve noticed another attack going after the same information, only this time it is via Chrome extensions (CRX files).\r\n\r\nWhile it currently only targets Roblox users, the same technique can be used to steal cookies from any website. The stolen information is sent via Discord, but this could also be configured to use other chat platforms. We learned this particular Chrome extension was, in fact, for sale on the Dream Market underground marketplace for only 99 cents"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-b328-4b76-b5e9-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:name = 'ROBLOX BOT.zip']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-1144-47c5-8833-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:name = 'Crm5extension.crx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-0c38-4ed1-bd79-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:name = 'Roblox Enhancer.crx']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-c98c-4588-8d41-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:name = 'danktrades.zip']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-9594-474f-8ee1-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:name = 'bgWork.js']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"filename\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-836c-4050-95ca-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[domain-name:value = '3rmillion.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"domain\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-63fc-4e16-bc14-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-07ec-4e8b-960b-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d4e425-5918-432e-a551-3f50950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'd9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-78a4-47e6-8d7d-45d702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '92d2ac44f7b11749fe040ab438ee736866edeafb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-f80c-419e-b758-4b6802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02",
|
||
|
|
"pattern": "[file:hashes.MD5 = '98f2e06a90a8d762a05fc7deeb74093f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59d51a40-6988-4a79-8984-481b02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"first_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"last_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59d51a40-6988-4a79-8984-481b02de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59d51a40-6988-4a79-8984-481b02de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/d9f21e401ef0197a2af66133e3f7fc3a4ea3efb4437884a4383076bad4060b02/analysis/1503970956/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-bd94-4247-bdc7-470f02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3",
|
||
|
|
"pattern": "[file:hashes.SHA1 = 'aef1f023f744bb3fe1ab8616d9d44391d6a0a03e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-5020-4fac-b79f-484e02de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3",
|
||
|
|
"pattern": "[file:hashes.MD5 = '178e598baf688ca318482751d38b5f33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59d51a40-c028-406c-a257-45a102de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"first_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"last_observed": "2017-10-04T17:28:32Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59d51a40-c028-406c-a257-45a102de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59d51a40-c028-406c-a257-45a102de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/4c4af30a94cd25b23579e12b64191a056bda3c51b6e531a2202d3863b19432b3/analysis/1503951674/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-caa0-4640-8256-4c1702de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00",
|
||
|
|
"pattern": "[file:hashes.SHA1 = '1bbf468286a00175ef032063f6b01c4c958a6b3a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha1\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--59d51a40-2a00-40e0-9edb-469902de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:32.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:32.000Z",
|
||
|
|
"description": "- Xchecked via VT: 0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0574437b0e697cf884726bb5e321be80']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-10-04T17:28:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--59d51a41-d934-4f2c-8e76-44d802de0b81",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-10-04T17:28:33.000Z",
|
||
|
|
"modified": "2017-10-04T17:28:33.000Z",
|
||
|
|
"first_observed": "2017-10-04T17:28:33Z",
|
||
|
|
"last_observed": "2017-10-04T17:28:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--59d51a41-d934-4f2c-8e76-44d802de0b81"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--59d51a41-d934-4f2c-8e76-44d802de0b81",
|
||
|
|
"value": "https://www.virustotal.com/file/0061a5f52c5b577f679e81da3ab3ad3803c20e345c16ffc4dbc8b76386d42a00/analysis/1504020369/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|