835 lines
33 KiB
JSON
835 lines
33 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5a3d03cd-08f0-41bf-89fd-4789950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:05.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:05.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "grouping",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "grouping--5a3d03cd-08f0-41bf-89fd-4789950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:05.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:05.000Z",
|
||
|
|
"name": "M2M - GlobeImposter \"..doc\" 2017-12-22 : \"Outstanding\n Statement\" - \"Customer Statement .7z\"",
|
||
|
|
"context": "suspicious-activity",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5a3d03ce-9c70-4487-bfd9-4a98950d210f",
|
||
|
|
"indicator--5a3d03cf-40c8-4830-aea3-4290950d210f",
|
||
|
|
"indicator--5a3d03d0-ea88-445e-9d27-4c5a950d210f",
|
||
|
|
"observed-data--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"indicator--5a3d03d3-1f2c-4c1b-8678-42c8950d210f",
|
||
|
|
"indicator--5a3d03d4-5ef4-4f67-8c5d-4e4f950d210f",
|
||
|
|
"indicator--5a3d03d6-f2d4-44e5-9f36-4a65950d210f",
|
||
|
|
"indicator--5a3d03d7-8d78-42d7-b3be-446a950d210f",
|
||
|
|
"observed-data--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"observed-data--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"indicator--5a3d03da-f0f0-4dcc-beef-45f7950d210f",
|
||
|
|
"indicator--5a3d03db-a2cc-4248-8670-4dc1950d210f",
|
||
|
|
"observed-data--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"indicator--5a3d03de-53f4-48ff-a4e4-4c52950d210f",
|
||
|
|
"indicator--5a3d03df-2a68-46ad-989b-485a950d210f",
|
||
|
|
"observed-data--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"indicator--5a3d03e1-4eac-46c6-8024-43be950d210f",
|
||
|
|
"indicator--5a3d03e2-36f4-443b-8e5a-49ca950d210f",
|
||
|
|
"observed-data--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"indicator--5a3d03e5-d4e0-459e-8512-443c950d210f",
|
||
|
|
"indicator--5a3d03e6-311c-4670-9873-4e25950d210f",
|
||
|
|
"observed-data--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"indicator--5a3d03ea-cd70-42e0-8ce9-4e4f950d210f",
|
||
|
|
"indicator--5a3d03eb-3bb4-4934-9715-43bc950d210f",
|
||
|
|
"observed-data--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"indicator--5a3d03ee-9214-4b53-94df-450f950d210f",
|
||
|
|
"indicator--5a3d03ef-6dbc-4ac2-8493-4d8f950d210f",
|
||
|
|
"observed-data--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"workflow:todo=\"expansion\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03ce-9c70-4487-bfd9-4a98950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:30.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:30.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'af961493e65629c755ce0de085a10c33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03cf-40c8-4830-aea3-4290950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:31.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:31.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.bodyclassics.org/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:31Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03d0-ea88-445e-9d27-4c5a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:32.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:32.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.bodyclassics.org']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:32Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:33.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:33.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:33Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:33Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03d1-8338-4299-af98-414d950d210f",
|
||
|
|
"value": "67.59.136.100"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03d3-1f2c-4c1b-8678-42c8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:35.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:35.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.erpbizsolutions.com/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:35Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03d4-5ef4-4f67-8c5d-4e4f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:36.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:36.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.erpbizsolutions.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:36Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03d6-f2d4-44e5-9f36-4a65950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:38.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:38.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.shopstation.com.au/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:38Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03d7-8d78-42d7-b3be-446a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:39.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:39.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.shopstation.com.au']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:40.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:40.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:40Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:40Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03d8-0a20-4e2e-86c7-c5ed950d210f",
|
||
|
|
"value": "104.27.175.50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:41.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:41.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:41Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:41Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03d9-7760-4433-baa3-5156950d210f",
|
||
|
|
"value": "104.27.174.50"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03da-f0f0-4dcc-beef-45f7950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:42.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:42.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.sigmahydraulics.com/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:42Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03db-a2cc-4248-8670-4dc1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:43.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:43.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.sigmahydraulics.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:43Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:44.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:44.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:44Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:44Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03dc-af4c-46ef-9ca8-4529950d210f",
|
||
|
|
"value": "103.235.105.64"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03de-53f4-48ff-a4e4-4c52950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:46.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:46.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.topcareerguide.info/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:46Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03df-2a68-46ad-989b-485a950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:47.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:47.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.topcareerguide.info']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:48.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:48.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:48Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:48Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03e0-c678-4ae6-94a2-5156950d210f",
|
||
|
|
"value": "50.62.25.129"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03e1-4eac-46c6-8024-43be950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:49.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:49.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.upperlensmagazine.com/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03e2-36f4-443b-8e5a-49ca950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:50.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:50.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.upperlensmagazine.com']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:52.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:52.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:52Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:52Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03e4-4144-4957-a833-46ca950d210f",
|
||
|
|
"value": "45.126.209.154"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03e5-d4e0-459e-8512-443c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:53.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:53.000Z",
|
||
|
|
"pattern": "[url:value = 'http://www.vayvonvietcombank24h.net/tOldHSYW']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:53Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03e6-311c-4670-9873-4e25950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:54.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:54.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'www.vayvonvietcombank24h.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:54Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:56.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:56.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:08:56Z",
|
||
|
|
"last_observed": "2017-12-22T13:08:56Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03e8-e890-4800-8c72-4035950d210f",
|
||
|
|
"value": "198.143.137.42"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03ea-cd70-42e0-8ce9-4e4f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:58.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:58.000Z",
|
||
|
|
"pattern": "[url:value = 'https://topyzscsu5poprxy.onion.link/shfgealjh.php']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03eb-3bb4-4934-9715-43bc950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:08:59.000Z",
|
||
|
|
"modified": "2017-12-22T13:08:59.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'topyzscsu5poprxy.onion.link']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:08:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:00.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:00.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:09:00Z",
|
||
|
|
"last_observed": "2017-12-22T13:09:00Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03ec-d0a8-46e7-856a-4832950d210f",
|
||
|
|
"value": "103.198.0.2"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03ee-9214-4b53-94df-450f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:02.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:02.000Z",
|
||
|
|
"pattern": "[url:value = 'http://psoeiras.net/js/count.php?nu=105&fb=110']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:09:02Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"url\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5a3d03ef-6dbc-4ac2-8493-4d8f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:03.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:03.000Z",
|
||
|
|
"pattern": "[domain-name:value = 'psoeiras.net']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2017-12-22T13:09:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Network activity"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"hostname\"",
|
||
|
|
"misp:category=\"Network activity\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2017-12-22T13:09:05.000Z",
|
||
|
|
"modified": "2017-12-22T13:09:05.000Z",
|
||
|
|
"first_observed": "2017-12-22T13:09:05Z",
|
||
|
|
"last_observed": "2017-12-22T13:09:05Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"ip-dst\"",
|
||
|
|
"misp:category=\"Network activity\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "network-traffic",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "network-traffic--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"dst_ref": "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"protocols": [
|
||
|
|
"tcp"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "ipv4-addr",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "ipv4-addr--5a3d03f1-2f00-4e37-8317-4c39950d210f",
|
||
|
|
"value": "74.220.219.67"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|