{ "type": "bundle", "id": "bundle--57189d1b-e90c-4d93-8383-41d8950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:47.000Z", "modified": "2016-04-21T15:18:47.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--57189d1b-e90c-4d93-8383-41d8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:47.000Z", "modified": "2016-04-21T15:18:47.000Z", "name": "OSINT - Your Package Has Been Successfully Encrypted: TeslaCrypt 4.1A and the Malware Attack Chain", "published": "2016-04-21T15:22:49Z", "object_refs": [ "x-misp-attribute--57189d38-d0dc-4f17-beef-4b07950d210f", "observed-data--57189d46-1b44-4f9c-a406-4eb1950d210f", "url--57189d46-1b44-4f9c-a406-4eb1950d210f", "indicator--57189db3-03d4-4938-9994-43ef950d210f", "indicator--57189db4-b1c4-454e-8c9c-4fd9950d210f", "indicator--57189ed5-5efc-4daa-84e3-4abb950d210f", "indicator--5718a6b3-31c4-4041-a039-4111950d210f", "indicator--5718a6b3-873c-4697-aa0e-493d950d210f", "indicator--5718a6b4-56bc-460a-90ac-4f34950d210f", "indicator--5718a6b4-f41c-4d92-8189-4d2f950d210f", "indicator--5718a6b4-8678-4648-aa94-4f9a950d210f", "indicator--5718a6b5-bf30-4316-9f6a-4c50950d210f", "indicator--5718a6b5-a4d8-4474-8d0d-49fe950d210f", "x-misp-attribute--5718a70f-5358-41d7-811e-4c10950d210f", "x-misp-attribute--5718a726-2e84-44a1-976e-429f950d210f", "x-misp-attribute--5718a73e-4be0-4507-a56d-4a7c950d210f", "x-misp-attribute--5718a75f-a6b8-468c-ba63-4926950d210f", "x-misp-attribute--5718a7e7-6190-4ae1-8f88-4133950d210f", "x-misp-attribute--5718a7f9-9ee0-4907-af67-4094950d210f", "x-misp-attribute--5718a830-b170-4aee-a070-4a48950d210f", "x-misp-attribute--5718a83f-9834-4f5e-90de-41c5950d210f", "x-misp-attribute--5718a885-ca6c-4558-86d2-44be950d210f", "x-misp-attribute--5718a894-a310-4d77-b40f-4187950d210f", "x-misp-attribute--5718a8a4-7cc4-4054-8adc-4c48950d210f", "x-misp-attribute--5718a8c3-6a78-4bdb-9225-48b3950d210f", "x-misp-attribute--5718a8d1-b3b8-4abf-a0f7-492f950d210f", "x-misp-attribute--5718a8e0-ce08-4df8-9f78-4881950d210f", "x-misp-attribute--5718a8f0-ca34-47ae-a3ba-453f950d210f", "x-misp-attribute--5718a92a-ca24-4be0-af31-4681950d210f", "x-misp-attribute--5718a948-5498-4c14-b324-42b2950d210f", "x-misp-attribute--5718a96f-b9ec-4609-af74-4192950d210f", "x-misp-attribute--5718a980-0264-4691-83bb-4ae7950d210f", "x-misp-attribute--5718a98b-1c50-4c87-91a5-4fde950d210f", "x-misp-attribute--5718a996-1b18-4796-9b04-4303950d210f", "x-misp-attribute--5718a9bc-91f4-4f97-a599-4fd7950d210f", "x-misp-attribute--5718a9cb-e8f0-4152-b90d-4075950d210f", "x-misp-attribute--5718a9d8-7108-450b-a5a6-4fd1950d210f", "x-misp-attribute--5718a9e6-234c-417f-8c61-4a37950d210f", "x-misp-attribute--5718b7e4-b3d4-47b1-a07c-4c0b950d210f", "x-misp-attribute--5718b7f5-90f4-410d-b3df-4be7950d210f", "x-misp-attribute--5718b802-6c30-4db5-ac12-4751950d210f", "x-misp-attribute--5718b80f-861c-463f-b8a0-45b5950d210f", "x-misp-attribute--5718b83d-6ccc-4836-a98c-44c6950d210f", "x-misp-attribute--5718b849-e6f0-4e32-bc12-4d90950d210f", "x-misp-attribute--5718b856-d3d0-435f-baad-4db1950d210f", "x-misp-attribute--5718b868-71e4-48bc-9cbf-4472950d210f", "x-misp-attribute--5718b87f-34f0-4432-88c0-4254950d210f", "x-misp-attribute--5718b88c-6714-4eb4-a050-4d12950d210f", "x-misp-attribute--5718b89f-8270-4459-b56c-40fd950d210f", "x-misp-attribute--5718b8af-0db0-4fbe-9dae-48c1950d210f", "indicator--5718ef57-26c0-4be6-842a-401f02de0b81", "indicator--5718ef57-9958-4cbc-a2a2-4ae902de0b81", "observed-data--5718ef57-522c-42f2-a266-4a3f02de0b81", "url--5718ef57-522c-42f2-a266-4a3f02de0b81", "indicator--5718ef58-7f00-469e-bd9b-463402de0b81", "observed-data--5718ef58-8bf0-4721-be56-4e0502de0b81", "url--5718ef58-8bf0-4721-be56-4e0502de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "type:OSINT", "malware_classification:malware-category=\"Ransomware\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57189d38-d0dc-4f17-beef-4b07950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T09:28:24.000Z", "modified": "2016-04-21T09:28:24.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "comment", "x_misp_value": "Ransomware quickly gained national headlines in February after the Hollywood Presbyterian Medical Center in Los Angeles paid $17,000 in bitcoins to regain access to its systems. Since then, other hospitals have similarly been attacked with ransomware, leading some industry experts to proclaim it an industry-specific crisis. Although it is commonly associated with directed campaigns aimed at high-value targets such as hospitals, ransomware is actually becoming less targeted and more omnidirectional. As our latest research on TeslaCrypt demonstrates, ransomware not only is becoming more widespread, but it is also becoming more sophisticated and adaptable. TeslaCrypt 4.1A is only a week old and contains an even greater variety of stealth and obfuscation techniques than its previous variants, the earliest of which is just over a year old. Organizations and individuals alike must be aware ransomware is equally likely to be found in personal networks as in critical infrastructure networks, and that its rapid transformation and growing sophistication presents significant challenges to the security community and significant threats to users of all kinds." }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57189d46-1b44-4f9c-a406-4eb1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T09:28:38.000Z", "modified": "2016-04-21T09:28:38.000Z", "first_observed": "2016-04-21T09:28:38Z", "last_observed": "2016-04-21T09:28:38Z", "number_observed": 1, "object_refs": [ "url--57189d46-1b44-4f9c-a406-4eb1950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57189d46-1b44-4f9c-a406-4eb1950d210f", "value": "https://www.endgame.com/blog/your-package-has-been-successfully-encrypted-teslacrypt-41a-and-malware-attack-chain" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57189db3-03d4-4938-9994-43ef950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T09:30:27.000Z", "modified": "2016-04-21T09:30:27.000Z", "description": "Imported via the freetext import.", "pattern": "[file:name = '80.exe' AND file:hashes.SHA256 = '8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T09:30:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename|sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57189db4-b1c4-454e-8c9c-4fd9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T09:30:28.000Z", "modified": "2016-04-21T09:30:28.000Z", "description": "Imported via the freetext import.", "pattern": "[file:name = 'transaction_wcVSdU.js' AND file:hashes.SHA256 = 'e2dcee410447911bb3bb7fa5731e06adcfe123fa09f43333dbffb9cca26c7163']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T09:30:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename|sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57189ed5-5efc-4daa-84e3-4abb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T09:35:17.000Z", "modified": "2016-04-21T09:35:17.000Z", "description": "TeslaCrypt payload", "pattern": "[file:hashes.MD5 = '6bfa1c01c3af6206a189b975178965fe']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T09:35:17Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b3-31c4-4041-a039-4111950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:51.000Z", "modified": "2016-04-21T10:08:51.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'loseweightwithmysite.com/sys_info.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b3-873c-4697-aa0e-493d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:51.000Z", "modified": "2016-04-21T10:08:51.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'greetingsyoungqq.com/80.exe']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b4-56bc-460a-90ac-4f34950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:52.000Z", "modified": "2016-04-21T10:08:52.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'helcel.com/sys_init.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b4-f41c-4d92-8189-4d2f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:52.000Z", "modified": "2016-04-21T10:08:52.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'thinktrimbebeautiful.com.au/sys_init.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b4-8678-4648-aa94-4f9a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:52.000Z", "modified": "2016-04-21T10:08:52.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'lorangeriedelareine.fr/sys_init.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b5-bf30-4316-9f6a-4c50950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:53.000Z", "modified": "2016-04-21T10:08:53.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'bluedreambd.com/inifile.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718a6b5-a4d8-4474-8d0d-49fe950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:08:53.000Z", "modified": "2016-04-21T10:08:53.000Z", "description": "Imported via the freetext import.", "pattern": "[url:value = 'onguso.com/inifile.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T10:08:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a70f-5358-41d7-811e-4c10950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:10:23.000Z", "modified": "2016-04-21T10:10:23.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2015-07-25" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a726-2e84-44a1-976e-429f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:11:22.000Z", "modified": "2016-04-21T10:11:22.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2016-04-11" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a73e-4be0-4507-a56d-4a7c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:11:10.000Z", "modified": "2016-04-21T10:11:10.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2015-09-01" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a75f-a6b8-468c-ba63-4926950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:11:43.000Z", "modified": "2016-04-21T10:11:43.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2012-07-05" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a7e7-6190-4ae1-8f88-4133950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:13:59.000Z", "modified": "2016-04-21T10:13:59.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2015-08-21" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a7f9-9ee0-4907-af67-4094950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:14:17.000Z", "modified": "2016-04-21T10:14:17.000Z", "labels": [ "misp:type=\"whois-creation-date\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-creation-date", "x_misp_value": "2016-03-17" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a830-b170-4aee-a070-4a48950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:15:12.000Z", "modified": "2016-04-21T10:15:12.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "whois@hostmonster.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a83f-9834-4f5e-90de-41c5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:15:27.000Z", "modified": "2016-04-21T10:15:27.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "abuse@hostmonster.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a885-ca6c-4558-86d2-44be950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:16:37.000Z", "modified": "2016-04-21T10:16:37.000Z", "labels": [ "misp:type=\"whois-registrant-phone\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-phone", "x_misp_value": "0018014948462" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a894-a310-4d77-b40f-4187950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:16:52.000Z", "modified": "2016-04-21T10:16:52.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "DOMAIN PRIVACY SERVICE FBO REGISTRANT" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a8a4-7cc4-4054-8adc-4c48950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:17:08.000Z", "modified": "2016-04-21T10:17:08.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "FastDomain Inc." }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a8c3-6a78-4bdb-9225-48b3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:17:39.000Z", "modified": "2016-04-21T10:17:39.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "99be7643aba6f315e9e3e062eaeb8ce3184804530203dd7b822bb45f1d55c69d@greetingsyoungqq.com.whoisproxy.org" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a8d1-b3b8-4abf-a0f7-492f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:17:53.000Z", "modified": "2016-04-21T10:17:53.000Z", "labels": [ "misp:type=\"whois-registrant-phone\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-phone", "x_misp_value": "006448319528" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a8e0-ce08-4df8-9f78-4881950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:18:08.000Z", "modified": "2016-04-21T10:18:08.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "On behalf of greetingsyoungqq.com OWNER" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a8f0-ca34-47ae-a3ba-453f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:18:24.000Z", "modified": "2016-04-21T10:18:24.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "Key-Systems GmbH" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a92a-ca24-4be0-af31-4681950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:19:22.000Z", "modified": "2016-04-21T10:19:22.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "helcel.com@contactprivacy.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a948-5498-4c14-b324-42b2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:19:52.000Z", "modified": "2016-04-21T10:19:52.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "registrars@ecommerce.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a96f-b9ec-4609-af74-4192950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:20:31.000Z", "modified": "2016-04-21T10:20:31.000Z", "labels": [ "misp:type=\"whois-registrant-phone\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-phone", "x_misp_value": "0014165385457" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a980-0264-4691-83bb-4ae7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:20:48.000Z", "modified": "2016-04-21T10:20:48.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "Contact Privacy Inc. Customer 0141203229" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a98b-1c50-4c87-91a5-4fde950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:20:59.000Z", "modified": "2016-04-21T10:20:59.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "Private Registrant" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a996-1b18-4796-9b04-4303950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:21:10.000Z", "modified": "2016-04-21T10:21:10.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "TUCOWS, INC." }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a9bc-91f4-4f97-a599-4fd7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:21:48.000Z", "modified": "2016-04-21T10:21:48.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "dougmccoy@hotmail.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a9cb-e8f0-4152-b90d-4075950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:22:03.000Z", "modified": "2016-04-21T10:22:03.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "domains@crazydomains.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a9d8-7108-450b-a5a6-4fd1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:22:16.000Z", "modified": "2016-04-21T10:22:16.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "DOUGLAS MCCOY" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718a9e6-234c-417f-8c61-4a37950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T10:22:30.000Z", "modified": "2016-04-21T10:22:30.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "CRAZY DOMAINS FZ-LLC" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b7e4-b3d4-47b1-a07c-4c0b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:22:12.000Z", "modified": "2016-04-21T11:22:12.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "hebergement@online.net" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b7f5-90f4-410d-b3df-4be7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:22:29.000Z", "modified": "2016-04-21T11:22:29.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "odysseeconsultin.957595@spamfree.bookmyname.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b802-6c30-4db5-ac12-4751950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:22:42.000Z", "modified": "2016-04-21T11:22:42.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "hostmaster@proxad.net" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b80f-861c-463f-b8a0-45b5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:22:55.000Z", "modified": "2016-04-21T11:22:55.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "ODYSSEE CONSULTING" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b83d-6ccc-4836-a98c-44c6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:23:41.000Z", "modified": "2016-04-21T11:23:41.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "raselnu86@gmail.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b849-e6f0-4e32-bc12-4d90950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:23:53.000Z", "modified": "2016-04-21T11:23:53.000Z", "labels": [ "misp:type=\"whois-registrant-phone\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-phone", "x_misp_value": "0088001932403451" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b856-d3d0-435f-baad-4db1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:24:06.000Z", "modified": "2016-04-21T11:24:06.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "Md. Shohag chowdhury" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b868-71e4-48bc-9cbf-4472950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:24:24.000Z", "modified": "2016-04-21T11:24:24.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "PDR Ltd. d/b/a PublicDomainRegistry.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b87f-34f0-4432-88c0-4254950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:24:47.000Z", "modified": "2016-04-21T11:24:47.000Z", "labels": [ "misp:type=\"whois-registrant-email\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-email", "x_misp_value": "lllcpxjqm@whoisprivacyprotect.com" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b88c-6714-4eb4-a050-4d12950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:25:00.000Z", "modified": "2016-04-21T11:25:00.000Z", "labels": [ "misp:type=\"whois-registrant-phone\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-phone", "x_misp_value": "0014252740657" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b89f-8270-4459-b56c-40fd950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:25:19.000Z", "modified": "2016-04-21T11:25:19.000Z", "labels": [ "misp:type=\"whois-registrant-name\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrant-name", "x_misp_value": "WHOIS AGENT" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5718b8af-0db0-4fbe-9dae-48c1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T11:25:35.000Z", "modified": "2016-04-21T11:25:35.000Z", "labels": [ "misp:type=\"whois-registrar\"", "misp:category=\"Attribution\"" ], "x_misp_category": "Attribution", "x_misp_type": "whois-registrar", "x_misp_value": "ENOM, INC." }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718ef57-26c0-4be6-842a-401f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:47.000Z", "modified": "2016-04-21T15:18:47.000Z", "description": "Imported via the freetext import. - Xchecked via VT: e2dcee410447911bb3bb7fa5731e06adcfe123fa09f43333dbffb9cca26c7163", "pattern": "[file:hashes.SHA1 = '35ef669b60f566e488dfb8b4487f5b074b7fc599']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T15:18:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718ef57-9958-4cbc-a2a2-4ae902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:47.000Z", "modified": "2016-04-21T15:18:47.000Z", "description": "Imported via the freetext import. - Xchecked via VT: e2dcee410447911bb3bb7fa5731e06adcfe123fa09f43333dbffb9cca26c7163", "pattern": "[file:hashes.MD5 = '0eec3406dfb374a7df4c2bb856db1625']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T15:18:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5718ef57-522c-42f2-a266-4a3f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:47.000Z", "modified": "2016-04-21T15:18:47.000Z", "first_observed": "2016-04-21T15:18:47Z", "last_observed": "2016-04-21T15:18:47Z", "number_observed": 1, "object_refs": [ "url--5718ef57-522c-42f2-a266-4a3f02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5718ef57-522c-42f2-a266-4a3f02de0b81", "value": "https://www.virustotal.com/file/e2dcee410447911bb3bb7fa5731e06adcfe123fa09f43333dbffb9cca26c7163/analysis/1461249074/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5718ef58-7f00-469e-bd9b-463402de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:48.000Z", "modified": "2016-04-21T15:18:48.000Z", "description": "Imported via the freetext import. - Xchecked via VT: 8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071", "pattern": "[file:hashes.SHA1 = '260dd322089862a5400a00dbcb35774b66ce2d47']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-04-21T15:18:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5718ef58-8bf0-4721-be56-4e0502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-04-21T15:18:48.000Z", "modified": "2016-04-21T15:18:48.000Z", "first_observed": "2016-04-21T15:18:48Z", "last_observed": "2016-04-21T15:18:48Z", "number_observed": 1, "object_refs": [ "url--5718ef58-8bf0-4721-be56-4e0502de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5718ef58-8bf0-4721-be56-4e0502de0b81", "value": "https://www.virustotal.com/file/8184432307b0f546d168e3e386a20999f5b0de0bd4085753bb2b09cfc7fec071/analysis/1461168082/" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }