958 lines
44 KiB
JSON
958 lines
44 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5bec7912-23c8-4a0a-9597-4818950d210f",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:52:32.000Z",
|
||
|
|
"modified": "2018-11-14T19:52:32.000Z",
|
||
|
|
"name": "CIRCL",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5bec7912-23c8-4a0a-9597-4818950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:52:32.000Z",
|
||
|
|
"modified": "2018-11-14T19:52:32.000Z",
|
||
|
|
"name": "OSINT - Big Game Hunting: The Evolution of INDRIK SPIDER From Dridex Wire Fraud to BitPaymer Targeted Ransomware",
|
||
|
|
"published": "2018-11-14T19:52:51Z",
|
||
|
|
"object_refs": [
|
||
|
|
"observed-data--5bec7922-56d0-472a-b570-4599950d210f",
|
||
|
|
"url--5bec7922-56d0-472a-b570-4599950d210f",
|
||
|
|
"x-misp-attribute--5bec793f-f704-43ae-8162-4900950d210f",
|
||
|
|
"x-misp-attribute--5bec79e2-6080-41e9-9173-4b73950d210f",
|
||
|
|
"x-misp-attribute--5bec79e2-a6ac-4115-8e72-416b950d210f",
|
||
|
|
"x-misp-attribute--5bec79e3-cbc4-4266-8b7e-402c950d210f",
|
||
|
|
"x-misp-attribute--5bec79e3-594c-4b62-a54a-434c950d210f",
|
||
|
|
"x-misp-attribute--5bec79e4-8028-4f25-9e5b-41a1950d210f",
|
||
|
|
"x-misp-attribute--5bec79e4-242c-439f-a877-4bf8950d210f",
|
||
|
|
"x-misp-attribute--5bec79e5-e97c-43bc-b88a-4234950d210f",
|
||
|
|
"indicator--5bec7a1c-c1b4-4104-a76b-4d2c950d210f",
|
||
|
|
"indicator--5bec7a1d-e8bc-4a58-ba53-4bbe950d210f",
|
||
|
|
"indicator--5bec7a1d-0f74-4784-936b-4996950d210f",
|
||
|
|
"indicator--5bec7a1e-9fb8-49d7-9da2-416e950d210f",
|
||
|
|
"indicator--5bec7a41-8ad8-461d-9e36-415f950d210f",
|
||
|
|
"indicator--5bec7a42-4e8c-4183-bc4a-4998950d210f",
|
||
|
|
"indicator--5bec7a42-d85c-4405-85b8-48df950d210f",
|
||
|
|
"indicator--5bec7a63-c380-4f94-98e9-465f950d210f",
|
||
|
|
"indicator--5bec7a65-1c80-4ddd-ba59-423f950d210f",
|
||
|
|
"indicator--5bec7a66-6944-481b-a1d6-44be950d210f",
|
||
|
|
"indicator--b0f2857c-a33a-4169-89bd-27c32ea7a55f",
|
||
|
|
"x-misp-object--f54d0bbe-87c4-4a46-a858-2ab024e5fba9",
|
||
|
|
"indicator--16a1a4c0-75d1-4175-9ab5-216843836c8e",
|
||
|
|
"x-misp-object--f8524365-0aa5-4b6c-952d-55a72a1eb88a",
|
||
|
|
"indicator--d1f561f1-c44c-4527-8c79-2d4e1aaa7d5e",
|
||
|
|
"x-misp-object--bbc46efb-01b5-47f3-939c-1ffeed6f8072",
|
||
|
|
"indicator--c16c8947-799a-4979-99e2-6ff2fe138e80",
|
||
|
|
"x-misp-object--e45a4b26-9967-451c-9f6f-094085d05516",
|
||
|
|
"indicator--7c569551-df75-4e31-b725-5bf3c9ff6003",
|
||
|
|
"x-misp-object--9cadd140-070d-43fd-9f73-236b04df16fb",
|
||
|
|
"indicator--b2fa253e-a483-4302-abe6-e4eadc311046",
|
||
|
|
"x-misp-object--c9aff31e-7cdb-44bb-9453-081f438e2442",
|
||
|
|
"indicator--4518aafb-e0c4-4363-ba7f-a6bbf57056c3",
|
||
|
|
"x-misp-object--750d600c-4e94-4aa7-acfa-726dc654a850",
|
||
|
|
"indicator--ef725b10-29e4-4870-8d1b-4fc434225570",
|
||
|
|
"x-misp-object--e60a48c7-c4d4-4824-a2eb-7e33b897a1f6"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:threat-actor=\"INDRIK SPIDER\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5bec7922-56d0-472a-b570-4599950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:42:42.000Z",
|
||
|
|
"modified": "2018-11-14T19:42:42.000Z",
|
||
|
|
"first_observed": "2018-11-14T19:42:42Z",
|
||
|
|
"last_observed": "2018-11-14T19:42:42Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"url--5bec7922-56d0-472a-b570-4599950d210f"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"link\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "url",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "url--5bec7922-56d0-472a-b570-4599950d210f",
|
||
|
|
"value": "https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec793f-f704-43ae-8162-4900950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:42:41.000Z",
|
||
|
|
"modified": "2018-11-14T19:42:41.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"text\"",
|
||
|
|
"misp:category=\"External analysis\"",
|
||
|
|
"osint:source-type=\"blog-post\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "External analysis",
|
||
|
|
"x_misp_type": "text",
|
||
|
|
"x_misp_value": "INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking trojans on the market and, since 2014, those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits. Throughout its years of operation, Dridex has received multiple updates with new modules developed and new anti-analysis features added to the malware."
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e2-6080-41e9-9173-4b73950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:14.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "12AWdHJkwF193ud21XWGontyCJTW6A9i6p"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e2-a6ac-4115-8e72-416b950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:14.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:14.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "1Ln9RxSRuDqqFhCTuqBPBKRMeyhVhRaUG4"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e3-cbc4-4266-8b7e-402c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:15.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "1BWj247jtipKr1wuFciKypeidZVwZWHCi9"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e3-594c-4b62-a54a-434c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:15.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:15.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "19aF868XPJhNqheXWgvrHPqnXpwhttf3Hw"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e4-8028-4f25-9e5b-41a1950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:16.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "14uAWnPnhtrXDB9DTBCruToawM65dUgwot"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e4-242c-439f-a877-4bf8950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:16.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:16.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "1PNmBWJHzJGqTUemastR7E4ccrUNASktmZ"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-attribute",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-attribute--5bec79e5-e97c-43bc-b88a-4234950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:39:17.000Z",
|
||
|
|
"modified": "2018-11-14T19:39:17.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"btc\"",
|
||
|
|
"misp:category=\"Financial fraud\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
],
|
||
|
|
"x_misp_category": "Financial fraud",
|
||
|
|
"x_misp_comment": "Ransom demands have varied significantly, suggesting that INDRIK SPIDER likely calculates the ransom amount based on the size and value of the victim organization. The lowest identified payment was for approximately $10,000 USD, and the highest observed was for close to $200,000 USD.",
|
||
|
|
"x_misp_type": "btc",
|
||
|
|
"x_misp_value": "1DWbPyjmbKA1NFqv3nyL47y9Vsz6WFU4Hw"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a1c-c1b4-4104-a76b-4d2c950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:12.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:12.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'c7f8c6e833243519cdc8dd327942d62a627fe9c0793d899448938a3f10149481']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:12Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a1d-e8bc-4a58-ba53-4bbe950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:13.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:13.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '17526923258ff290ff5ca553248b5952a65373564731a2b8a0cff10e56c293a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a1d-0f74-4784-936b-4996950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:13.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:13.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '282b7a6d1648e08c02846820324d932ccc224affe94793e9d63ff46818003636']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:13Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a1e-9fb8-49d7-9da2-416e950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:14.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:14.000Z",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '8943356b0288b9463e96d6d0f4f24db068ea47617299071e6124028a8160db9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:14Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a41-8ad8-461d-9e36-415f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:49.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:49.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for unpacked BitPaymer decryptor samples analyzed by Falcon Intelligence.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f0e600bdca5c6a5eae155cc82aad718fe68d7571b7c106774b4c731baa01a50c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:49Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a42-4e8c-4183-bc4a-4998950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:50.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:50.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for unpacked BitPaymer decryptor samples analyzed by Falcon Intelligence.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'b44e61de54b97c0492babbf8c56fad0c1f03cb2b839bad8c1c8d3bcd0591a010']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a42-d85c-4405-85b8-48df950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:40:50.000Z",
|
||
|
|
"modified": "2018-11-14T19:40:50.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for unpacked BitPaymer decryptor samples analyzed by Falcon Intelligence.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '13209680c091e180ed1d9a87090be9c10876db403c40638a24b5bc893fd87587']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:40:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a63-c380-4f94-98e9-465f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:41:23.000Z",
|
||
|
|
"modified": "2018-11-14T19:41:23.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for Dridex samples deployed during the initial stages of a BitPaymer compromise.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '91c0c6ab8a1fe428958f33da590bdd52baec868c7011461da8a8972c3d989d42']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:41:23Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a65-1c80-4ddd-ba59-423f950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:41:25.000Z",
|
||
|
|
"modified": "2018-11-14T19:41:25.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for Dridex samples deployed during the initial stages of a BitPaymer compromise.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = 'f1d69b69f53af9ea83fe8281e5c1745737fd42977597491f942755088c994d8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:41:25Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5bec7a66-6944-481b-a1d6-44be950d210f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:41:26.000Z",
|
||
|
|
"modified": "2018-11-14T19:41:26.000Z",
|
||
|
|
"description": "The following table contains SHA256 hashes for Dridex samples deployed during the initial stages of a BitPaymer compromise.",
|
||
|
|
"pattern": "[file:hashes.SHA256 = '39e7a9b0ea00316b232b3d0f8c511498ca5b6aee95abad0c3f1275ef029a0bef']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:41:26Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"sha256\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b0f2857c-a33a-4169-89bd-27c32ea7a55f",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:47.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:47.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '2f698222f435a172c253efd8823a44e9' AND file:hashes.SHA1 = 'ffd9a2358ca91092f9971ab9f2371355c29aecfa' AND file:hashes.SHA256 = '8943356b0288b9463e96d6d0f4f24db068ea47617299071e6124028a8160db9c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:46:47Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f54d0bbe-87c4-4a46-a858-2ab024e5fba9",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:49.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:49.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-11-02T14:02:19",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "e33d7d1e-4da9-43e9-84a6-a9ae79cb186e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/8943356b0288b9463e96d6d0f4f24db068ea47617299071e6124028a8160db9c/analysis/1541167339/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "741457c4-c8c6-4a3e-b79c-784d87e0e180"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "45/68",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "6845d2cc-98cc-4015-9df9-297f3da01598"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--16a1a4c0-75d1-4175-9ab5-216843836c8e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:50.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:50.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'a7940a68ec460c278530e7dac0e763f5' AND file:hashes.SHA1 = 'e2a10004f3a561b0154558e18220015ed513ee0b' AND file:hashes.SHA256 = 'f0e600bdca5c6a5eae155cc82aad718fe68d7571b7c106774b4c731baa01a50c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:46:50Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--f8524365-0aa5-4b6c-952d-55a72a1eb88a",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:51.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:51.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2017-07-22T00:22:47",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "babf5755-e988-41ba-a7c2-b5950f61978e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/f0e600bdca5c6a5eae155cc82aad718fe68d7571b7c106774b4c731baa01a50c/analysis/1500682967/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "3eb0641e-c27c-432a-8f8f-bf21a9051103"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "25/64",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "fc8e0e97-56c2-414c-a4fe-07f60e88a6c6"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--d1f561f1-c44c-4527-8c79-2d4e1aaa7d5e",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:52.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:52.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'aa62e73c5be24dbce7c07179faa0da63' AND file:hashes.SHA1 = '40908d3d0c30a4189767fcd3e90d59ea05ee159b' AND file:hashes.SHA256 = 'f1d69b69f53af9ea83fe8281e5c1745737fd42977597491f942755088c994d8e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:46:52Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--bbc46efb-01b5-47f3-939c-1ffeed6f8072",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:54.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:54.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-05-25T16:44:10",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "d8c2486b-de51-4652-aaaa-222890e58608"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/f1d69b69f53af9ea83fe8281e5c1745737fd42977597491f942755088c994d8e/analysis/1527266650/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "6209a06d-0a7d-4cf4-8b36-6b932887c64b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "34/65",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "f3e21b07-86b9-4c8e-a770-9cf59a654a64"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--c16c8947-799a-4979-99e2-6ff2fe138e80",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:55.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:55.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e7430c45f8e5d247e58516dccd9d4446' AND file:hashes.SHA1 = '0c47af6e89778d78fdc427897e6790611b2a5478' AND file:hashes.SHA256 = '17526923258ff290ff5ca553248b5952a65373564731a2b8a0cff10e56c293a4']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:46:55Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e45a4b26-9967-451c-9f6f-094085d05516",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:57.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:57.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-04-05T10:56:06",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "00b0652a-d528-4bd7-a798-50727592979e"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/17526923258ff290ff5ca553248b5952a65373564731a2b8a0cff10e56c293a4/analysis/1522925766/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "b6aba310-292d-4543-97e3-e4267e10d806"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "47/66",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "18dae5ef-53f4-4189-80ce-7f37b85989da"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--7c569551-df75-4e31-b725-5bf3c9ff6003",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:58.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:58.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c785093151fa52d84c53dbd0683dcd77' AND file:hashes.SHA1 = '8ae1c1869c42daa035032341804aefc3e7f3caf1' AND file:hashes.SHA256 = 'c7f8c6e833243519cdc8dd327942d62a627fe9c0793d899448938a3f10149481']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:46:58Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--9cadd140-070d-43fd-9f73-236b04df16fb",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:46:59.000Z",
|
||
|
|
"modified": "2018-11-14T19:46:59.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-09-19T17:05:59",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "7c88d2a9-1c98-45f6-b9cb-b7899748b76b"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/c7f8c6e833243519cdc8dd327942d62a627fe9c0793d899448938a3f10149481/analysis/1537376759/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "171548dc-1a5a-4649-b2b2-48832b1329db"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "53/67",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "4ff6e238-1631-47f1-8937-9dbc7637f412"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--b2fa253e-a483-4302-abe6-e4eadc311046",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:01.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:01.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b4142bf602459ebb2eafe3727bcf802d' AND file:hashes.SHA1 = '89482b5eb043b53fbf603edf2cbc2764e03a37be' AND file:hashes.SHA256 = '13209680c091e180ed1d9a87090be9c10876db403c40638a24b5bc893fd87587']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:47:01Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--c9aff31e-7cdb-44bb-9453-081f438e2442",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:02.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:02.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-04-13T05:45:26",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ab703310-6b46-4623-966d-5566db028b28"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/13209680c091e180ed1d9a87090be9c10876db403c40638a24b5bc893fd87587/analysis/1523598326/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "74ad52a8-3e9a-40a8-ac70-ec084c29b972"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "38/66",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "3976d104-78ec-45ad-b242-46627c352074"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--4518aafb-e0c4-4363-ba7f-a6bbf57056c3",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:03.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:03.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1a7ed250f66368c19abe07ca0283fb5' AND file:hashes.SHA1 = '38718bfaf0aa3e87e17d240257e3dd118fb080f7' AND file:hashes.SHA256 = 'b44e61de54b97c0492babbf8c56fad0c1f03cb2b839bad8c1c8d3bcd0591a010']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:47:03Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--750d600c-4e94-4aa7-acfa-726dc654a850",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:05.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:05.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-03-29T13:57:36",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "c2165e42-7de1-495f-9368-d460f5de29ba"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/b44e61de54b97c0492babbf8c56fad0c1f03cb2b839bad8c1c8d3bcd0591a010/analysis/1522331856/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "04d4c510-6efa-42df-bfa0-d628e03f5a7d"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "37/65",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "a4d9ba7e-17fb-4011-8cb7-f5aa53004fad"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--ef725b10-29e4-4870-8d1b-4fc434225570",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:06.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:06.000Z",
|
||
|
|
"pattern": "[file:hashes.MD5 = '28945b625617cfdcc444b428de0a7a00' AND file:hashes.SHA1 = '9cab670cd0d11e901cdb3f197aa18f1a6e2930ba' AND file:hashes.SHA256 = '282b7a6d1648e08c02846820324d932ccc224affe94793e9d63ff46818003636']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2018-11-14T19:47:06Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "file"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"file\"",
|
||
|
|
"misp:meta-category=\"file\"",
|
||
|
|
"misp:to_ids=\"True\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "x-misp-object",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "x-misp-object--e60a48c7-c4d4-4824-a2eb-7e33b897a1f6",
|
||
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
||
|
|
"created": "2018-11-14T19:47:07.000Z",
|
||
|
|
"modified": "2018-11-14T19:47:07.000Z",
|
||
|
|
"labels": [
|
||
|
|
"misp:name=\"virustotal-report\"",
|
||
|
|
"misp:meta-category=\"misc\""
|
||
|
|
],
|
||
|
|
"x_misp_attributes": [
|
||
|
|
{
|
||
|
|
"type": "datetime",
|
||
|
|
"object_relation": "last-submission",
|
||
|
|
"value": "2018-06-26T03:02:46",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "79d41d4b-bc05-4936-a740-6dc7e58ed0d3"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "link",
|
||
|
|
"object_relation": "permalink",
|
||
|
|
"value": "https://www.virustotal.com/file/282b7a6d1648e08c02846820324d932ccc224affe94793e9d63ff46818003636/analysis/1529982166/",
|
||
|
|
"category": "External analysis",
|
||
|
|
"uuid": "6dcbcaa5-df30-425e-9fd0-f4a532c0fdce"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "text",
|
||
|
|
"object_relation": "detection-ratio",
|
||
|
|
"value": "51/67",
|
||
|
|
"category": "Other",
|
||
|
|
"uuid": "ab54dd48-ee28-4c91-9174-e4ff1367358a"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"x_misp_meta_category": "misc",
|
||
|
|
"x_misp_name": "virustotal-report"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|