1306 lines
730 KiB
JSON
1306 lines
730 KiB
JSON
|
{
|
||
|
|
"type": "bundle",
|
||
|
|
"id": "bundle--5c2f9787-fb54-4046-816b-3a6d0acd0835",
|
||
|
|
"objects": [
|
||
|
|
{
|
||
|
|
"type": "identity",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2020-12-09T14:44:48.000Z",
|
||
|
|
"modified": "2020-12-09T14:44:48.000Z",
|
||
|
|
"name": "Synovus Financial",
|
||
|
|
"identity_class": "organization"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "report",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "report--5c2f9787-fb54-4046-816b-3a6d0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2020-12-09T14:44:48.000Z",
|
||
|
|
"modified": "2020-12-09T14:44:48.000Z",
|
||
|
|
"name": "FBI FLASH AB-000102-MW",
|
||
|
|
"published": "2019-01-04T17:37:05Z",
|
||
|
|
"object_refs": [
|
||
|
|
"indicator--5c2f987b-2198-4958-bdf5-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-4098-4e1e-bf64-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-6204-45a4-a230-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-adc4-43df-b144-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-55f4-48e4-a3ff-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-47b8-4b09-ab4c-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-39a0-4777-aac0-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-3974-4a78-a6cd-92aaf9de0052",
|
||
|
|
"indicator--5c2f987b-f99c-42b9-b1d7-92aaf9de0052",
|
||
|
|
"observed-data--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"file--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"artifact--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"indicator--5c2f98cb-c194-4699-bb7e-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-2230-4c81-aeb9-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-b578-4379-b7ed-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-90fc-4387-8c78-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-69a0-4d5a-9383-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-0540-4131-a347-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-81fc-4496-95b9-9330f9de0052",
|
||
|
|
"indicator--5c2f98cb-4144-4be8-89c4-9330f9de0052",
|
||
|
|
"indicator--5c2f98f3-f8b0-4bb9-9f30-937ff9de0052",
|
||
|
|
"indicator--5c2f98f4-fc40-4842-b01d-937ff9de0052",
|
||
|
|
"indicator--5c2f98f4-5d48-4141-9988-937ff9de0052",
|
||
|
|
"indicator--5c2f9962-c15c-4dc3-b454-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-ee70-4b9d-b60e-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-4c8c-4d8a-8e59-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-37cc-47a4-b435-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-b5d8-481b-83b5-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-e0c4-41a7-ae77-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-fc88-4a0d-b19a-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-027c-43d1-9cf1-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-17c0-48e3-94e6-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-1b30-49ec-ad77-958cf9de0052",
|
||
|
|
"indicator--5c2f9962-3e94-4ea5-9af1-958cf9de0052",
|
||
|
|
"indicator--5c2f998a-ded0-42b2-b7d7-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-44d8-4c21-ab41-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-db90-4056-80cd-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-1558-4ffd-8248-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-39c4-4b4f-bccf-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-dfec-4ccd-ac2c-95c1f9de0052",
|
||
|
|
"indicator--5c2f998a-8d30-4fb7-9492-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-4354-4b80-805c-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-08ec-4040-be40-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-e1d4-4049-8939-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-0fe4-4090-9e13-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-33cc-4ebe-b302-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-171c-487f-8936-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-c8d0-434c-9536-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-e3bc-4572-bc50-95c1f9de0052",
|
||
|
|
"indicator--5c2f998b-77c0-43d9-ad14-95c1f9de0052"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"Threat-Report",
|
||
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
||
|
|
"misp-galaxy:threat-actor=\"Stone Panda\""
|
||
|
|
],
|
||
|
|
"object_marking_refs": [
|
||
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-2198-4958-bdf5-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '6a1c14d5f16a07bef55943134fe618c0']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-4098-4e1e-bf64-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '81df89d6fa0b26cadd4e50ef5350f341']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-6204-45a4-a230-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b3139b26a2dabb9b6e728884d8fa8b33']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-adc4-43df-b144-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '06b0af6ff00647f57119d8a261829f73']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-55f4-48e4-a3ff-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '080f8017607bb14e0b1ad25ec6e400f5']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-47b8-4b09-ab4c-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '265cf3ddc1e43449ae067e0e405ecd2f']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-39a0-4777-aac0-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4f1ffebb45b30dd3496caaf1fa9c77e3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-3974-4a78-a6cd-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '627b903657b28f3a2e388393103722c8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f987b-f99c-42b9-b1d7-92aaf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:31:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:31:39.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '797b450509e9cad63d30cd596ac8b608']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:31:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "observed-data",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "observed-data--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:29.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:29.000Z",
|
||
|
|
"first_observed": "2019-01-04T17:32:29Z",
|
||
|
|
"last_observed": "2019-01-04T17:32:29Z",
|
||
|
|
"number_observed": 1,
|
||
|
|
"object_refs": [
|
||
|
|
"file--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"artifact--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835"
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"attachment\"",
|
||
|
|
"misp:category=\"External analysis\""
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "file",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "file--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"name": "flash_chinese_apt10.pdf",
|
||
|
|
"content_ref": "artifact--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835"
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "artifact",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "artifact--5c2f98ad-5cb4-4fe8-8aaf-68cf0acd0835",
|
||
|
|
"payload_bin": "JVBERi0xLjUNJeLjz9MNCjExNyAwIG9iag08PC9MaW5lYXJpemVkIDEvTCA1MjE4ODEvTyAxMTkvRSAzMjE4NDMvTiAxNi9UIDUyMTQwMC9IIFsgNDk4IDMzOF0+Pg1lbmRvYmoNICAgICAgICAgICAgDQoxMzMgMCBvYmoNPDwvRGVjb2RlUGFybXM8PC9Db2x1bW5zIDUvUHJlZGljdG9yIDEyPj4vRmlsdGVyL0ZsYXRlRGVjb2RlL0lEWzwwRjNFMUJFMEI3Mjk2RjQxQTY2NzQwOTAzMDIyODJEOD48QjYxOEYzRkU0QUM0REU0QTk3NDIzODg2Q0IzMTQzQzQ+XS9JbmRleFsxMTcgMjldL0luZm8gMTE2IDAgUi9MZW5ndGggODkvUHJldiA1MjE0MDEvUm9vdCAxMTggMCBSL1NpemUgMTQ2L1R5cGUvWFJlZi9XWzEgMyAxXT4+c3RyZWFtDQpo3mJiZGAQYGBiYGA2AZEMviCSqQsschJEsoSA2SxgcilYJBrMFgOTSWCRRSCySBgssgtIMuVyAUnG1i1A8m/lZAYmoC1gExgYGMkk/zMwVn0DCDAAD9gMLw0KZW5kc3RyZWFtDWVuZG9iag1zdGFydHhyZWYNCjANCiUlRU9GDQogICAgICAgIA0KMTQ1IDAgb2JqDTw8L0ZpbHRlci9GbGF0ZURlY29kZS9JIDMxMy9MZW5ndGggMjU1L1MgMjQ1Pj5zdHJlYW0NCmjeYmBgYAIiewYWBgaWWgZhBgQQBoqxAjHHAQYGQQUGBok5KgtkY1j+N0x4wFPFNJvBcwfHVsbNDlJ3WEIZrBTYFwG1LBE4wB6e1t7e0eKSDuSy+Xnd+HCKM5pZQzWHZ8GTtf08c6ZufDh5AZCYIrTNxago7NgeBKEZzTR1gyZU8dRNCuwdDQwVHYziHQzsHYyiFSCqgSG9o0EJyBTv6GB0B2Lzjg52MARKAgUbiHMikNJhYEsqB9J8YI8CAaM6gyCDYcOKBtcFsheEP3BcYL7HZM1oO8eawahsn41KbsMaBga91wybg3Yy1B6ABJAxA/sXQZBWIF4JEGAArUtbcg0KZW5kc3RyZWFtDWVuZG9iag0xMTggMCBvYmoNPDwvTGFuZyhlbi1VUykvTWV0YWRhdGEgNDkgMCBSL1BhZ2VzIDExNSAwIFIvVHlwZS9DYXRhbG9nPj4NZW5kb2JqDTExOSAwIG9iag08PC9Bbm5vdHNbMTM0IDAgUl0vQ29udGVudHNbMTIxIDAgUiAxMjIgMCBSIDEyMyAwIFIgMTI0IDAgUiAxMjUgMCBSIDEyNiAwIFIgMTI3IDAgUiAxMjkgMCBSXS9Dcm9wQm94WzAgMCA2MTIgNzkyXS9Hcm91cDw8L0NTL0RldmljZVJHQi9TL1RyYW5zcGFyZW5jeS9UeXBlL0dyb3VwPj4vTWVkaWFCb3hbMCAwIDYxMiA3OTJdL1BhcmVudCAxMTUgMCBSL1Jlc291cmNlczw8L0V4dEdTdGF0ZTw8L0dTNSAxMzUgMCBSPj4vRm9udDw8L0YxIDEzOCAwIFIvRjIgMTQxIDAgUi9GMyAxNDQgMCBSPj4vUHJvY1NldFsvUERGL1RleHQvSW1hZ2VCL0ltYWdlQy9JbWFnZUldL1hPYmplY3Q8PC9JbWFnZTQgMTI4IDAgUj4+Pj4vUm90YXRlIDAvVGFicy9TL1R5cGUvUGFnZT4+DWVuZG9iag0xMjAgMCBvYmoNPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0ZpcnN0IDkxL0xlbmd0aCA4NzIvTiAxMS9UeXBlL09ialN0bT4+c3RyZWFtDQpo3qyV224bNxCGX2UuWxQWz6cgECo5VhsgyYWVxAUMX6zljbyIrDWkTeq8ff4hV7KVxAvXKBajITnkcEh+M1LGkiRlHCkVoD0pp6ADmYAxE8knDZ0o2kTKYq70EQ3FwiOwusA9QyokHrGklZT08qWYQObiw+lr8f7bbS0mi65p19z/7aZqVl37YvHt36pbXP/56bIZLduvv4/HYjrHojOSaM7IitN60Z3bONIJIRk5UojKhxE6zo18vBDzL5cdO3/TrD+Px1g7fSvetZubalU2Pbnr/pp3VVeLRUUqz5hsF/W6o+CkmHxdnjVX3TU548Vxdft33Syvi+lVXaYdaXRmq2q5JaPFrF1302l7d37kcHy2kdK4Fqy4yMZZs6r5xiTu9TSPvKtucPbp8auTkz+Oq1VzuWmOpu3qKhvP+g2lFK87GBeT9XJVkxRvq7sSmQouiXlX33xEkOVMvJDD2zS3XbsR//RRI5jx+Fxrj0A9yQefUToLt7WLZKQn7QNZhOlkOBD54HcnOtz7s95QTAADPpxX5HQiDz82RrKO2wGisn8DDYvGimDJsxWenOFIHPzYAEkOFkMuKUrs07FPSYefTRbrELGKWTtpcCIPD2VcW47QRplbUZkyy/SzTQaGDAA1tvR572Bdjpm9mBQuGJ9qW/P9/vLFTtaL9qpZL8VZs56st82+P2s22+74utrsGLl/npxVzMKbqp+itBYZipna4/t+86XOb7t/YJGff5uTEcsfJ1er/0ou7m6AXDVE7kNo7RC01uyg1U+EdvfUATnuoyatFUA1WSyAY3RlQdcB5+h/Qvcx0ShZLLL3UxAGOCGRswyQIY9d7xFW5AFt3gdpzjhaSARCHnh5r8mhXnog5FD4MkIRfVRDB+xjAt6qjFnP6cZPWH77CHhn7XJqZJ14FnRQua+RUBpV17rS5srK406HXgNmVGSDpDGm9C2i5buzhiPCvSGx+KxyAOvnEp1+JNr2ROunEG3l/0x0wPF7ov0viNaDtbggPAT2kVIP0E7RPhdtmcGWg1jHQZTlAdSHNTKjrPWjKJdZBWJGgxGWPcB6D7Dc43tYf2NeYbNYVN6sQ8F2N67z3949tKq3mKxxSuxlYirI8nok0x5ZO1h/+1d6Hq9W/8ir6nk1T+LVFF6/CzAA0lVXSg0KZW5kc3RyZWFtDWVuZG9iag0xMjEgMCBvYmoNPDwvRmlsdGVyL0ZsYXRlRGVjb2RlL0xlbmd0aCA3ODE+PnN0cmVhbQ0KSIm0V1tPFDEUfp9k/kN9a41Tenqd+gYBuQQRcM3GEB8Qdhcju8QFNPx7z2l31xlDNMYOJJPm9Jx+37m2u7X/3rHZfV19qysPICNT+A9WSe0YGOmYdyCDY1fzuto6nF/OJpbt3rGzulJsVlc6WAksuFbGwFyQCq0c6S8ndTV9WVc7I7R7Aww0SUfTuoIMwVamHjc0G81pY0af/bq64COhLT8WAPz0tWjA8bHQmh+k5aFotM8ae+ITGx3V1d5ojaQZeqH7SMaABNeFStxVhmKdMzAKZ/mkja0nnzRIRYfOnzfAL+lFy1oljbUYAyVby7zCCPoUi/FLttgouqRHEUa9aLJe29HbRK3NuB1n0Amy9BZ9SoRYoySYyEZXF1zpDrezInhk2YXr+18Iw8q2j3G0jUlW/EQ0YQA8gICV/nwItYLyeNYmk46DsTyIMzIWzBR2ku4BBJeyhJ2M2hlgW4Dnt9iVkU+Wwjj+ILRB2Aa/J0IDfxTa8bmwkX+mFSqVZERzypo+pfLVYlvZMhex73KxUEPoVCvbO8XBfJQtin7BXfCmOAhmEroedSeIUjDAFAEdaQQP6xYYS+XQS5XSkHP1dlwez3sZej4NVXx4s4Z2dUmSfDlbr87THTbGFlR4G9KXCWjz4NzrSHeFzTsfqS3ficg/oNzw8zRnBxjpnq4NZ/wfWB8It2J3LAI/FU3LXwxSefEvRP53TuKL57fHDc5isnTg5frZcCjA8qlI0W5cy58w8sDvMC+PKIh56wvlbXGdktXg6+cSV4unNGCzgPRXh5TmbHG+Mxu9jOtZ+nCDaBMa6ff0FJushjso3yGaVleisYnsw53wfEnXwn1xgoDN4EOfYvkw0D2q+yAU9MUARYKWzIYg7bpGOjWxpGbNOV9M6O58+LEJ7ddUEEMEWEvf9im9EqATD2cSsUSgfCx8kA5FFicdhBX0zSU6/J3e+avKK+6
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-c194-4699-bb7e-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c9460df90bd8db84428b8c4d3db1e1e1']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-2230-4c81-aeb9-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c9e7710e9255e3b17524738501fa8d45']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-b578-4379-b7ed-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd2d086f62f3fcdc5be8eba3879e04b90']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-90fc-4387-8c78-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dd0494eb1ab29e577354fca895bec92a']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-69a0-4d5a-9383-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ddc8df45efe202623b3c917d766c9317']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-0540-4131-a347-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e2627a887898b641db720531258fd133']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-81fc-4496-95b9-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ed65bbe9498d3fb1e4d4ac0058590d88']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98cb-4144-4be8-89c4-9330f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:32:59.000Z",
|
||
|
|
"modified": "2019-01-04T17:32:59.000Z",
|
||
|
|
"description": "REDLEAVES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'fb0c714cd2ebdcc6f33817abe7813c36']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:32:59Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"REDLEAVES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98f3-f8b0-4bb9-9f30-937ff9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:33:39.000Z",
|
||
|
|
"modified": "2019-01-04T17:33:39.000Z",
|
||
|
|
"description": "UPPERCUT/ANEL",
|
||
|
|
"pattern": "[file:hashes.MD5 = '4f83c01e8f7507d23c67ab085bf79e97']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:33:39Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"UPPERCUT",
|
||
|
|
"ANEL"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98f4-fc40-4842-b01d-937ff9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:33:40.000Z",
|
||
|
|
"modified": "2019-01-04T17:33:40.000Z",
|
||
|
|
"description": "UPPERCUT/ANEL",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'cca227f70a64e1e7fcf5bccdc6cc25dd']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:33:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"UPPERCUT",
|
||
|
|
"ANEL"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f98f4-5d48-4141-9988-937ff9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:33:40.000Z",
|
||
|
|
"modified": "2019-01-04T17:33:40.000Z",
|
||
|
|
"description": "UPPERCUT/ANEL",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f188936d2c8423cf064d6b8160769f21']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:33:40Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"UPPERCUT",
|
||
|
|
"ANEL"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-c15c-4dc3-b454-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '19610f0d343657f6842d2045e8818f09']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-ee70-4b9d-b60e-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '0c0a39e1cab4fc9896bdf5ef3c96a716']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-4c8c-4d8a-8e59-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '23d03ee4bf57de7087055b230dae7c5b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-37cc-47a4-b435-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c1cb28327d3364768d1c1e4ce0d9bc07']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-b5d8-481b-83b5-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'db212129be94fe77362751c557d0e893']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-e0c4-41a7-ae77-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '07abd6583295061eac2435ae470eff78']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-fc88-4a0d-b19a-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '7891f00dcab0e4a2f928422062e94213']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-027c-43d1-9cf1-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '8a93859e5f7079d6746832a3a22ff65c']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-17c0-48e3-94e6-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3afa9243b3aeb534e02426569d85e517']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-1b30-49ec-ad77-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'dbb867c2250b5be4e67d1977fcf721fb']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f9962-3e94-4ea5-9af1-958cf9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:35:30.000Z",
|
||
|
|
"modified": "2019-01-04T17:35:30.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'd1bab4a30f2889ad392d17573302f097']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:35:30Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-ded0-42b2-b7d7-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1d0105cf8e076b33ed499f1dfef9a46b']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-44d8-4c21-ab41-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '472b1710794d5c420b9d921c484ca9e8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-db90-4056-80cd-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '684888079aaf7ed25e725b55a3695062']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-1558-4ffd-8248-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ca9644ef0f7ed355a842f6e2d4511546']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-39c4-4b4f-bccf-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '37c89f291dbe880b1f3ac036e6b9c558']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-dfec-4ccd-ac2c-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c0c8dcc9dad39da8278bf8956e30a3fc']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998a-8d30-4fb7-9492-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:10.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:10.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'b0649c1f7fb15796805ca983fd8f95a3']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:10Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-4354-4b80-805c-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '1b891bc2e5038615efafabe48920f200']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-08ec-4040-be40-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f5744d72c6919f994ff452b0e758ffee']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-e1d4-4049-8939-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f586edd88023f49bc4f9d84f9fb6bd7d']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-0fe4-4090-9e13-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'f03f70d331c6564aec8931f481949188']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-33cc-4ebe-b302-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '75500bb4143a052795ec7d2e61ac3261']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-171c-487f-8936-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = '3cbb5664d70bbe62f19ee28f26f21d7e']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-c8d0-434c-9536-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'ac725400d9a5fe832dd40a1afb2951f8']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-e3bc-4572-bc50-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'c2a07ca21ecad714821df647ada8ecaa']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "indicator",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "indicator--5c2f998b-77c0-43d9-ad14-95c1f9de0052",
|
||
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
||
|
|
"created": "2019-01-04T17:36:11.000Z",
|
||
|
|
"modified": "2019-01-04T17:36:11.000Z",
|
||
|
|
"description": "CHCHES",
|
||
|
|
"pattern": "[file:hashes.MD5 = 'e8f3790cfac1b104965dead841dc20b2']",
|
||
|
|
"pattern_type": "stix",
|
||
|
|
"pattern_version": "2.1",
|
||
|
|
"valid_from": "2019-01-04T17:36:11Z",
|
||
|
|
"kill_chain_phases": [
|
||
|
|
{
|
||
|
|
"kill_chain_name": "misp-category",
|
||
|
|
"phase_name": "Payload delivery"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"labels": [
|
||
|
|
"misp:type=\"md5\"",
|
||
|
|
"misp:category=\"Payload delivery\"",
|
||
|
|
"misp:to_ids=\"True\"",
|
||
|
|
"CHCHES"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"type": "marking-definition",
|
||
|
|
"spec_version": "2.1",
|
||
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
||
|
|
"created": "2017-01-20T00:00:00.000Z",
|
||
|
|
"definition_type": "tlp",
|
||
|
|
"name": "TLP:WHITE",
|
||
|
|
"definition": {
|
||
|
|
"tlp": "white"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|