{ "type": "bundle", "id": "bundle--5ace0663-370c-40d0-b651-44f4950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:57:01.000Z", "modified": "2018-04-11T14:57:01.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5ace0663-370c-40d0-b651-44f4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:57:01.000Z", "modified": "2018-04-11T14:57:01.000Z", "name": "OSINT - IcedID Banking Trojan Teams up with Rovnix for Distribution", "published": "2018-04-11T14:57:19Z", "object_refs": [ "observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f", "url--5ace06a2-3540-4b10-93c1-4d5c950d210f", "x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f", "indicator--5ace0764-684c-435f-947e-4c52950d210f", "indicator--5ace0765-c62c-4282-8cbf-42e5950d210f", "indicator--5ace0765-1b44-4bee-897b-4a28950d210f", "indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f", "indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f", "indicator--5ace07c0-dde4-4249-a568-4d83950d210f", "indicator--5ace07c1-e79c-436d-a3da-4025950d210f", "indicator--5ace07c1-9300-4d27-b73a-4c60950d210f", "indicator--5ace07c2-50cc-4691-b529-4a6d950d210f", "indicator--5ace07c2-4b6c-461f-acbb-4678950d210f", "indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f", "indicator--5ace07c3-ae30-4de1-8300-432f950d210f", "indicator--5ace07c4-8d80-4388-8b65-41a4950d210f", "indicator--5ace07c4-202c-40ad-91af-445c950d210f", "indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f", "indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f", "indicator--5ace07c6-c994-477a-8609-49ef950d210f", "indicator--5ace07c6-096c-4d43-afa3-41d6950d210f", "indicator--5ace07c7-c1f4-4249-854b-4d05950d210f", "indicator--5ace07c7-ca7c-4245-9331-41f3950d210f", "indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f", "indicator--5ace07c9-406c-4a41-95a2-4603950d210f", "indicator--5ace07c9-d5e8-408b-99b5-4133950d210f", "indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f", "indicator--5ace07ca-e130-43b0-a823-4da4950d210f", "indicator--5ace07ca-eed4-481c-8342-4cd9950d210f", "indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f", "indicator--5ace07cc-5b50-4fc6-841f-4332950d210f", "indicator--5ace0811-b73c-458b-a293-4c2b950d210f", "indicator--5ace0812-6e48-4501-b367-4a2e950d210f", "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d", "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0", "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2", "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f", "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f", "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e", "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9", "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67", "indicator--82693e02-8fc5-467c-9eba-707ae180d347", "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b", "indicator--d8060440-11f0-4674-8694-784e4c5a5325", "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e", "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16", "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863", "indicator--6656459f-8619-49cd-84c9-ca816054ee27", "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5", "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2", "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf", "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb", "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e", "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283", "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd", "indicator--8e710904-eb33-4fed-9104-5997e11aa525", "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31", "indicator--f63376a8-74ab-4697-806c-3cac1c460c50", "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94", "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed", "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e", "indicator--99530dee-a6be-43e5-a901-355807d5e959", "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f", "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629", "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0", "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad", "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f", "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f", "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452", "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e", "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b", "indicator--2228da8c-df64-430c-82ea-408a9961b7af", "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f", "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049", "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e", "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec", "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f", "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9", "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2", "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426", "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255", "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e", "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f", "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec", "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee", "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95", "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf", "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6", "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7", "relationship--f87e5d47-f356-4bf3-87d2-5efa4df6bfd3", "relationship--241787f5-1965-416c-8c2e-a86523173c19", "relationship--1a49188c-8877-4792-bfa2-4f457356595a", "relationship--949acb42-fb2f-40a1-adb1-7c0947439b6b", "relationship--cbed9ad8-8483-4aba-99a3-ae2fff2f49ac", "relationship--da0dba7c-dde0-4ea3-a321-258420b7a015", "relationship--3a4fa578-e881-4c36-a880-fcd2939534a2", "relationship--dfd6b514-ef6e-45d5-90f0-bd68e7296df4", "relationship--7615dac9-858d-496c-8729-2f80c982ec01", "relationship--42d4e5ba-69a5-4b41-b1f3-98ae998e3dca", "relationship--b5dfab89-fd30-4a42-a595-c1442cb90c86", "relationship--eb88c9df-c293-41c2-83d7-c8a52cef7aef", "relationship--c66fc892-5f97-4034-a5fd-97656bd70631", "relationship--d92cd3c6-bbd6-49ba-a6a4-cfb3d2a782a2", "relationship--933081cc-7bb3-4698-966b-b354e9a02778", "relationship--f5b6831d-070f-4606-a56a-af77b9a753f7", "relationship--58987338-21d4-4fd0-9a09-bd3c2cd7c9ae", "relationship--bf2000e8-eada-4c08-a59e-36476a71bffc", "relationship--9bbb47af-cd07-4f4a-8aa0-46b62a701ca0", "relationship--9a99bd71-6dc6-4453-8f4c-e84f658dc56e", "relationship--c92da31f-b429-4cd5-bf98-a9b1d5fc7abd", "relationship--73301c2d-9717-4f44-ad26-b0bd6ed1f1d3", "relationship--22f7c64f-a63d-4e62-9a70-e091bae535f6", "relationship--f954e40c-e0b2-468a-a360-8f1b05d8dbf7", "relationship--380065fe-721f-4d08-86ba-a9b0249dab14", "relationship--0c174c3c-3634-40b4-b51e-1a39d3f81883", "relationship--77ccbdc8-af1a-4a60-8592-264396ccf826", "relationship--5bc0d659-6ef1-46bc-80c3-17c92de73580" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:banker=\"IcedID\"", "workflow:todo=\"create-missing-misp-galaxy-cluster\"", "workflow:todo=\"create-missing-misp-galaxy-cluster-values\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:47.000Z", "modified": "2018-04-11T14:54:47.000Z", "first_observed": "2018-04-11T14:54:47Z", "last_observed": "2018-04-11T14:54:47Z", "number_observed": 1, "object_refs": [ "url--5ace06a2-3540-4b10-93c1-4d5c950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"", "osint:source-type=\"blog-post\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5ace06a2-3540-4b10-93c1-4d5c950d210f", "value": "http://blog.talosintelligence.com/2018/04/icedid-banking-trojan.html" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:48.000Z", "modified": "2018-04-11T14:54:48.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"", "osint:source-type=\"blog-post\"" ], "x_misp_category": "External analysis", "x_misp_type": "comment", "x_misp_value": "Cisco has noticed an increase in infections by the banking trojan IcedID through our Advanced Malware Protection (AMP) system. Security researchers first reported a new banking Trojan known as \"IcedID\" [1] in November 2017. At the time of discovery, IcedID was being distributed by Emotet, another well-known banking trojan malware. In late February and throughout March 2018, we noticed an increase in infections from IcedID being detected throughout the AMP ecosystem. Like in November 2017, some of the infections could be traced to Emotet, but this time, many detections could instead be traced to emails with attached malicious Microsoft Word documents containing macros. When the malicious documents are opened and the macros are enabled, Rovnix, another trojan, would be downloaded and executed, which subsequently downloads IcedID. In addition to Rovnix, many of the samples downloaded a second payload, a Bytecoin miner (Bytecoin is a crypto currency similar to bitcoin)." }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace0764-684c-435f-947e-4c52950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:02:28.000Z", "modified": "2018-04-11T13:02:28.000Z", "description": "Malicious Document", "pattern": "[file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:02:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace0765-c62c-4282-8cbf-42e5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:02:29.000Z", "modified": "2018-04-11T13:02:29.000Z", "description": "Rovnix", "pattern": "[file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:02:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace0765-1b44-4bee-897b-4a28950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:02:29.000Z", "modified": "2018-04-11T13:02:29.000Z", "description": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)", "pattern": "[file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:02:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:03:59.000Z", "modified": "2018-04-11T13:03:59.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:03:59Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:00.000Z", "modified": "2018-04-11T13:04:00.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c0-dde4-4249-a568-4d83950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:00.000Z", "modified": "2018-04-11T13:04:00.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c1-e79c-436d-a3da-4025950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:01.000Z", "modified": "2018-04-11T13:04:01.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c1-9300-4d27-b73a-4c60950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:01.000Z", "modified": "2018-04-11T13:04:01.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c2-50cc-4691-b529-4a6d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:02.000Z", "modified": "2018-04-11T13:04:02.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:02Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c2-4b6c-461f-acbb-4678950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:02.000Z", "modified": "2018-04-11T13:04:02.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:02Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:03.000Z", "modified": "2018-04-11T13:04:03.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c3-ae30-4de1-8300-432f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:03.000Z", "modified": "2018-04-11T13:04:03.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c4-8d80-4388-8b65-41a4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:04.000Z", "modified": "2018-04-11T13:04:04.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c4-202c-40ad-91af-445c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:04.000Z", "modified": "2018-04-11T13:04:04.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:05.000Z", "modified": "2018-04-11T13:04:05.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:05Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:05.000Z", "modified": "2018-04-11T13:04:05.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:05Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c6-c994-477a-8609-49ef950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:06.000Z", "modified": "2018-04-11T13:04:06.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c6-096c-4d43-afa3-41d6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:06.000Z", "modified": "2018-04-11T13:04:06.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c7-c1f4-4249-854b-4d05950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:07.000Z", "modified": "2018-04-11T13:04:07.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:07Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c7-ca7c-4245-9331-41f3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:07.000Z", "modified": "2018-04-11T13:04:07.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:07Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:08.000Z", "modified": "2018-04-11T13:04:08.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:08Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c9-406c-4a41-95a2-4603950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:08.000Z", "modified": "2018-04-11T13:04:08.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:08Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c9-d5e8-408b-99b5-4133950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:09.000Z", "modified": "2018-04-11T13:04:09.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:09Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:09.000Z", "modified": "2018-04-11T13:04:09.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:09Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07ca-e130-43b0-a823-4da4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:10.000Z", "modified": "2018-04-11T13:04:10.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07ca-eed4-481c-8342-4cd9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:10.000Z", "modified": "2018-04-11T13:04:10.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:11.000Z", "modified": "2018-04-11T13:04:11.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:11Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace07cc-5b50-4fc6-841f-4332950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T13:04:12.000Z", "modified": "2018-04-11T13:04:12.000Z", "description": "IcedID binaries", "pattern": "[file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T13:04:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace0811-b73c-458b-a293-4c2b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:48.000Z", "modified": "2018-04-11T14:54:48.000Z", "pattern": "[domain-name:value = 'efoijowufjaowudawd.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ace0812-6e48-4501-b367-4a2e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:48.000Z", "modified": "2018-04-11T14:54:48.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.123.64.43']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:52.000Z", "modified": "2018-04-11T14:54:52.000Z", "pattern": "[file:hashes.MD5 = 'de0f64b2cc9cdff5a94ea64828bf90b2' AND file:hashes.SHA1 = '3268a5fcebd1297bdcb12f649d36174d63e15d41' AND file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:50.000Z", "modified": "2018-04-11T14:54:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-30T06:28:47", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ba-435c-4cf5-bdb4-403e02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c/analysis/1522391327/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21ba-910c-4c87-82af-4c1602de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "43/65", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21bb-c0bc-40aa-a922-48a402de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:54.000Z", "modified": "2018-04-11T14:54:54.000Z", "pattern": "[file:hashes.MD5 = '22ff684a20a1f1ede284761a5c57a384' AND file:hashes.SHA1 = 'e417cd53530be1fcd42f859013c58c16eaac3385' AND file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:52.000Z", "modified": "2018-04-11T14:54:52.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-10T13:22:52", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21bc-2de4-4ca2-b500-451502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842/analysis/1520688172/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21bd-7eb0-4c67-85f0-4b9002de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "36/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21bd-481c-4bc1-8431-45de02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:56.000Z", "modified": "2018-04-11T14:54:56.000Z", "pattern": "[file:hashes.MD5 = '02562517436df9302ebb50f2594766f7' AND file:hashes.SHA1 = 'ffbe3d79715cce770bfc61c3f33d32f8c36bb97b' AND file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:55.000Z", "modified": "2018-04-11T14:54:55.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-02T19:13:43", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21bf-b0d4-4747-85ea-466f02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f/analysis/1522696423/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21bf-f27c-462e-a3da-46ca02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "50/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c0-cc30-4577-96c2-446502de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:59.000Z", "modified": "2018-04-11T14:54:59.000Z", "pattern": "[file:hashes.MD5 = 'a63746f323cdeca4b13c2cdcd5463c7a' AND file:hashes.SHA1 = '77fc4e19f659803a379d0fa47008a904af55f54f' AND file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:54:59Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:57.000Z", "modified": "2018-04-11T14:54:57.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-06T08:43:30", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c1-43f0-4bc0-8e89-47ba02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914/analysis/1523004210/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21c2-077c-4973-b9ac-47b002de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "42/65", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c2-1750-4cb0-8191-40d302de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--82693e02-8fc5-467c-9eba-707ae180d347", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:01.000Z", "modified": "2018-04-11T14:55:01.000Z", "pattern": "[file:hashes.MD5 = '5933c9c8483252be0bffd8a3bfb4dcc6' AND file:hashes.SHA1 = 'eae0c11f5d7a5004868982152797ee0121d28704' AND file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:54:59.000Z", "modified": "2018-04-11T14:54:59.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-05T20:00:04", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c4-514c-4f5c-9521-41ae02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e/analysis/1522958404/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21c4-c648-4d32-b174-4c9e02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "50/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c5-222c-4cfe-b70a-43cc02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d8060440-11f0-4674-8694-784e4c5a5325", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:04.000Z", "modified": "2018-04-11T14:55:04.000Z", "pattern": "[file:hashes.MD5 = '25672dcae009a4bb84b4095397376146' AND file:hashes.SHA1 = '9f39267a26079cda994a533823194534e00866dc' AND file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:03.000Z", "modified": "2018-04-11T14:55:03.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-22T07:48:09", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c7-9ae8-49e4-b2fa-43f902de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad/analysis/1521704889/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21c7-aa40-4b28-8cf1-450202de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "46/65", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c8-49d4-427c-bd16-40e802de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:07.000Z", "modified": "2018-04-11T14:55:07.000Z", "pattern": "[file:hashes.MD5 = 'd11515bda0737ddbd8fa6dc8e9a6093e' AND file:hashes.SHA1 = '76a5655b74d2b65343f6a5f760a8ba8609691238' AND file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:07Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:05.000Z", "modified": "2018-04-11T14:55:05.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-24T05:23:21", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21c9-0e68-4e9b-83ed-417502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8/analysis/1521869001/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21c9-8a50-4af0-a5a0-41e602de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "36/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ca-f0e4-4771-82d9-455302de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6656459f-8619-49cd-84c9-ca816054ee27", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:09.000Z", "modified": "2018-04-11T14:55:09.000Z", "pattern": "[file:hashes.MD5 = '073b555c56edc56c220cbbb8cbdc7d1a' AND file:hashes.SHA1 = '34ea6b41d518e3ae16c0b52bf5889c0db1466a98' AND file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:09Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:07.000Z", "modified": "2018-04-11T14:55:07.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-11T09:48:06", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21cb-6938-4413-bb6c-47c902de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860/analysis/1523440086/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21cc-62e8-4ab0-9f80-441b02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "55/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21cd-3710-47fb-96fc-44ce02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:12.000Z", "modified": "2018-04-11T14:55:12.000Z", "pattern": "[file:hashes.MD5 = 'f9e3f15a41b6dd4ab25d95a957abee6a' AND file:hashes.SHA1 = '794e1343af82ac981e77a5c086ed9e6c25ecfbc1' AND file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:10.000Z", "modified": "2018-04-11T14:55:10.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-11T09:22:06", "category": "Other", "comment": "Rovnix", "uuid": "5ace21ce-ead0-4911-9180-492902de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis/1523438526/", "category": "External analysis", "comment": "Rovnix", "uuid": "5ace21ce-5d4c-4ace-b76e-414802de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/67", "category": "Other", "comment": "Rovnix", "uuid": "5ace21cf-0ee0-43fb-8da8-4b0e02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:14.000Z", "modified": "2018-04-11T14:55:14.000Z", "pattern": "[file:hashes.MD5 = '46e96df14e74915e86a22516d4c111be' AND file:hashes.SHA1 = 'bb948aaa1b0a6f3dd5f5b3b9917411875f100ac3' AND file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:13.000Z", "modified": "2018-04-11T14:55:13.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-02T17:50:19", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d1-dc04-4263-8a3e-4bd702de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330/analysis/1522691419/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21d1-0658-4e4d-bb9f-4ab902de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "49/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d1-4a20-45b1-ba60-4d8b02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:16.000Z", "modified": "2018-04-11T14:55:16.000Z", "pattern": "[file:hashes.MD5 = 'd515779b40cac09f1b28caed78406ade' AND file:hashes.SHA1 = 'c944aa2b8b363c671ef9c80eb97ab9465a3b41a2' AND file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:15.000Z", "modified": "2018-04-11T14:55:15.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-05T19:59:15", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d3-dd00-4449-b426-433402de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae/analysis/1522958355/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21d3-0878-4c9c-8c0f-420402de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "39/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d3-1478-4a0a-8079-422102de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8e710904-eb33-4fed-9104-5997e11aa525", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:19.000Z", "modified": "2018-04-11T14:55:19.000Z", "pattern": "[file:hashes.MD5 = '60e1089b8a0b4d02981d305ddf60953c' AND file:hashes.SHA1 = '2c320e30337b6e5c18c5abe1734bab125fd571f2' AND file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:17.000Z", "modified": "2018-04-11T14:55:17.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-02T08:09:27", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d5-08c0-4fae-b03b-40d902de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509/analysis/1522656567/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21d5-efec-42d5-85e8-41d502de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "35/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d6-605c-4780-b782-425802de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f63376a8-74ab-4697-806c-3cac1c460c50", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:21.000Z", "modified": "2018-04-11T14:55:21.000Z", "pattern": "[file:hashes.MD5 = 'be79cd947879a66db8c1f11b598a250b' AND file:hashes.SHA1 = '4723713da700594f1ba484b7e993e0cdf072b87f' AND file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:19.000Z", "modified": "2018-04-11T14:55:19.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-23T15:24:31", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d8-72bc-4dd9-9e5e-40a602de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15/analysis/1521818671/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21d8-185c-489f-83e4-476c02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "48/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21d8-128c-42d0-ab99-403d02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:23.000Z", "modified": "2018-04-11T14:55:23.000Z", "pattern": "[file:hashes.MD5 = 'd4abe68c54567b9db2bc35a03ae91bc9' AND file:hashes.SHA1 = '6d9e86c0066b21b02b941034389fe4bd96293961' AND file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:23Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:22.000Z", "modified": "2018-04-11T14:55:22.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-11T09:45:54", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21da-09ac-4637-a101-45f502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e/analysis/1523439954/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21da-7e10-482f-b41d-4dfd02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "52/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21db-eea8-4e6c-98f4-4b1502de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--99530dee-a6be-43e5-a901-355807d5e959", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:26.000Z", "modified": "2018-04-11T14:55:26.000Z", "pattern": "[file:hashes.MD5 = '86f8c16a3241f99136391428a107c30a' AND file:hashes.SHA1 = 'a4459860666c7ef8006f01c2b787093128f17c11' AND file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:26Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:24.000Z", "modified": "2018-04-11T14:55:24.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-10T08:24:33", "category": "Other", "comment": "Malicious Document", "uuid": "5ace21dc-bb44-48a5-807f-435502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032/analysis/1523348673/", "category": "External analysis", "comment": "Malicious Document", "uuid": "5ace21dc-b318-41ac-a08e-403602de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "33/60", "category": "Other", "comment": "Malicious Document", "uuid": "5ace21dd-c404-4f89-8a6a-4d2f02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:28.000Z", "modified": "2018-04-11T14:55:28.000Z", "pattern": "[file:hashes.MD5 = '1562e6fc78c2b71ece80d783263bef82' AND file:hashes.SHA1 = '2fa2f0738d3c8935ee87427da7d10768282fe139' AND file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:26.000Z", "modified": "2018-04-11T14:55:26.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-30T08:29:37", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21de-d024-4a20-8084-4fe102de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff/analysis/1522398577/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21df-7448-4bdd-92d2-407802de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21df-89b0-466f-9250-454302de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:30.000Z", "modified": "2018-04-11T14:55:30.000Z", "pattern": "[file:hashes.MD5 = '9e0fca43d0ddfff8198a0885bd264d3a' AND file:hashes.SHA1 = 'e338ef5198c2bd588eb980931582e7705db28866' AND file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:28.000Z", "modified": "2018-04-11T14:55:28.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-02T19:30:12", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e1-c080-402d-b8a4-4a7c02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5/analysis/1522697412/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21e1-f394-4bf6-8267-43bd02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "50/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e1-2dac-489c-b8c0-4aae02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:32.000Z", "modified": "2018-04-11T14:55:32.000Z", "pattern": "[file:hashes.MD5 = '6bf4004030ce5238ec2b130d6ce861b9' AND file:hashes.SHA1 = '0d6f36b77d30db9c08c830da8fe0e30312d18515' AND file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:32Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:31.000Z", "modified": "2018-04-11T14:55:31.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-28T21:41:05", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e3-48bc-48c2-922a-4dde02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef/analysis/1522273265/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21e3-11d8-4390-a4ba-491202de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "27/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e4-ad54-450a-bc97-43e902de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:35.000Z", "modified": "2018-04-11T14:55:35.000Z", "pattern": "[file:hashes.MD5 = '6d1c4739b4a9cb7b78930a45687402b1' AND file:hashes.SHA1 = '2cb241c465a7300b6d4c1f3fc9d58daa53e424c7' AND file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:33.000Z", "modified": "2018-04-11T14:55:33.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-06T07:50:13", "category": "Other", "comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)", "uuid": "5ace21e5-22c0-4dc7-b0dc-441502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/d5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25/analysis/1523001013/", "category": "External analysis", "comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)", "uuid": "5ace21e5-6bc0-4abf-991f-425302de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "42/66", "category": "Other", "comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)", "uuid": "5ace21e6-9750-42d0-971c-43da02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2228da8c-df64-430c-82ea-408a9961b7af", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:37.000Z", "modified": "2018-04-11T14:55:37.000Z", "pattern": "[file:hashes.MD5 = 'f25b97573927299e975d786e2a42bd32' AND file:hashes.SHA1 = '7d79296d9cfe36cca96997c2983b3b820e25ffed' AND file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:35.000Z", "modified": "2018-04-11T14:55:35.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-19T18:35:27", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e7-14b4-413f-b893-499202de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c/analysis/1521484527/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21e8-fabc-4f31-9eef-4b6302de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "47/65", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e8-7d24-45bb-b059-491702de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:39.000Z", "modified": "2018-04-11T14:55:39.000Z", "pattern": "[file:hashes.MD5 = '1a9323b210ec81404aa509b9079fd71e' AND file:hashes.SHA1 = 'd12766fd4a4275d48cc94c20c6bb0cf7878352c7' AND file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:37.000Z", "modified": "2018-04-11T14:55:37.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-26T00:31:21", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21e9-66b4-4a67-8ff4-4e9402de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8/analysis/1522024281/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21ea-79ac-44a8-95d5-4f6d02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "29/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ea-8d60-4c30-9996-4e6902de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:41.000Z", "modified": "2018-04-11T14:55:41.000Z", "pattern": "[file:hashes.MD5 = 'dcd0ca97e1f341bcca4dbcf0facc7908' AND file:hashes.SHA1 = '607dce9aa1d528701e7fb6439560673f3ed799d6' AND file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:40.000Z", "modified": "2018-04-11T14:55:40.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-14T19:08:10", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ec-3e98-44c0-b97c-4af202de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb/analysis/1521054490/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21ec-02e0-442b-a470-42b702de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "43/64", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ed-bb90-47d5-929c-42e302de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:44.000Z", "modified": "2018-04-11T14:55:44.000Z", "pattern": "[file:hashes.MD5 = 'e16d5492bfb200fe4269988868c185e0' AND file:hashes.SHA1 = '73bc3b6561e3864f3fc5a719c369c95b00ac800d' AND file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:42.000Z", "modified": "2018-04-11T14:55:42.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-23T13:59:34", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ee-8dd4-4848-9a4b-422d02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc/analysis/1521813574/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21ef-39e4-4821-865e-4d7802de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "45/67", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21ef-79f8-4758-9e96-42bc02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:46.000Z", "modified": "2018-04-11T14:55:46.000Z", "pattern": "[file:hashes.MD5 = 'c28f58ce162bc146a5d44e2473e39210' AND file:hashes.SHA1 = 'e340fec254c3e813726f6fc8939dc8486ec76082' AND file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:44.000Z", "modified": "2018-04-11T14:55:44.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-05T20:21:19", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f1-c4bc-4b23-9575-4b1102de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f/analysis/1522959679/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21f1-17cc-4486-940f-408f02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/65", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f1-5068-49a3-89fb-457002de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:48.000Z", "modified": "2018-04-11T14:55:48.000Z", "pattern": "[file:hashes.MD5 = '1aefa7f9824f775504550360b5cc90c0' AND file:hashes.SHA1 = '9d3745c8ab300c6df60732923e328482f2ca52bd' AND file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:47.000Z", "modified": "2018-04-11T14:55:47.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-25T13:10:29", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f3-87bc-4035-97d4-498a02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55/analysis/1521983429/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21f3-bc18-48c3-86ed-4a6202de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "42/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f4-9a24-40ca-bc4c-45ee02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:51.000Z", "modified": "2018-04-11T14:55:51.000Z", "pattern": "[file:hashes.MD5 = '7b56a528f8f6155555fa360b3c36c8da' AND file:hashes.SHA1 = 'f4d2bd10a6a16b4fca17507483e963e194389f65' AND file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:49.000Z", "modified": "2018-04-11T14:55:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-04-10T21:29:30", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f5-d428-40bb-ae55-44fb02de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338/analysis/1523395770/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21f6-410c-47a2-9b82-46ee02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "54/66", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f6-6ad8-4a0d-a010-474b02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:53.000Z", "modified": "2018-04-11T14:55:53.000Z", "pattern": "[file:hashes.MD5 = 'e3b5fe82eb8f4162b1d4d6d861447ecf' AND file:hashes.SHA1 = '2093fbf65cbe5fed4289f4ce252527cc0ff0b9c3' AND file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:51.000Z", "modified": "2018-04-11T14:55:51.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-07T01:24:50", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f7-4134-4212-bc2a-4a3602de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de/analysis/1520385890/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21f8-c38c-45dd-ab89-48dc02de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "45/68", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21f8-a18c-41e0-8975-4d2a02de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "pattern": "[file:hashes.MD5 = '3c6a6ca8a46a6adf19a0d3b1b0a7be27' AND file:hashes.SHA1 = 'a21db84f0d6c67e5550a421a23998adf2ad1082a' AND file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-04-11T14:55:55Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-04-11T14:55:54.000Z", "modified": "2018-04-11T14:55:54.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-03-22T08:55:19", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21fa-ff58-410e-8e7e-41b502de0b81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869/analysis/1521708919/", "category": "External analysis", "comment": "IcedID binaries", "uuid": "5ace21fa-5f88-4533-a756-498402de0b81" }, { "type": "text", "object_relation": "detection-ratio", "value": "47/68", "category": "Other", "comment": "IcedID binaries", "uuid": "5ace21fb-8f14-4523-a9bd-451902de0b81" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f87e5d47-f356-4bf3-87d2-5efa4df6bfd3", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d", "target_ref": "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--241787f5-1965-416c-8c2e-a86523173c19", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2", "target_ref": "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a49188c-8877-4792-bfa2-4f457356595a", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f", "target_ref": "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--949acb42-fb2f-40a1-adb1-7c0947439b6b", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9", "target_ref": "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cbed9ad8-8483-4aba-99a3-ae2fff2f49ac", "created": "2018-04-11T14:55:55.000Z", "modified": "2018-04-11T14:55:55.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--82693e02-8fc5-467c-9eba-707ae180d347", "target_ref": "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--da0dba7c-dde0-4ea3-a321-258420b7a015", "created": "2018-04-11T14:55:56.000Z", "modified": "2018-04-11T14:55:56.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--d8060440-11f0-4674-8694-784e4c5a5325", "target_ref": "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--3a4fa578-e881-4c36-a880-fcd2939534a2", "created": "2018-04-11T14:55:56.000Z", "modified": "2018-04-11T14:55:56.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16", "target_ref": "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--dfd6b514-ef6e-45d5-90f0-bd68e7296df4", "created": "2018-04-11T14:55:56.000Z", "modified": "2018-04-11T14:55:56.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--6656459f-8619-49cd-84c9-ca816054ee27", "target_ref": "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--7615dac9-858d-496c-8729-2f80c982ec01", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2", "target_ref": "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--42d4e5ba-69a5-4b41-b1f3-98ae998e3dca", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb", "target_ref": "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b5dfab89-fd30-4a42-a595-c1442cb90c86", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283", "target_ref": "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--eb88c9df-c293-41c2-83d7-c8a52cef7aef", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--8e710904-eb33-4fed-9104-5997e11aa525", "target_ref": "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c66fc892-5f97-4034-a5fd-97656bd70631", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--f63376a8-74ab-4697-806c-3cac1c460c50", "target_ref": "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d92cd3c6-bbd6-49ba-a6a4-cfb3d2a782a2", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed", "target_ref": "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--933081cc-7bb3-4698-966b-b354e9a02778", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--99530dee-a6be-43e5-a901-355807d5e959", "target_ref": "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f5b6831d-070f-4606-a56a-af77b9a753f7", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629", "target_ref": "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--58987338-21d4-4fd0-9a09-bd3c2cd7c9ae", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad", "target_ref": "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--bf2000e8-eada-4c08-a59e-36476a71bffc", "created": "2018-04-11T14:55:57.000Z", "modified": "2018-04-11T14:55:57.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f", "target_ref": "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9bbb47af-cd07-4f4a-8aa0-46b62a701ca0", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e", "target_ref": "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9a99bd71-6dc6-4453-8f4c-e84f658dc56e", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--2228da8c-df64-430c-82ea-408a9961b7af", "target_ref": "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c92da31f-b429-4cd5-bf98-a9b1d5fc7abd", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049", "target_ref": "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--73301c2d-9717-4f44-ad26-b0bd6ed1f1d3", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec", "target_ref": "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--22f7c64f-a63d-4e62-9a70-e091bae535f6", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9", "target_ref": "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f954e40c-e0b2-468a-a360-8f1b05d8dbf7", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426", "target_ref": "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--380065fe-721f-4d08-86ba-a9b0249dab14", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e", "target_ref": "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0c174c3c-3634-40b4-b51e-1a39d3f81883", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec", "target_ref": "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--77ccbdc8-af1a-4a60-8592-264396ccf826", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95", "target_ref": "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--5bc0d659-6ef1-46bc-80c3-17c92de73580", "created": "2018-04-11T14:55:58.000Z", "modified": "2018-04-11T14:55:58.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6", "target_ref": "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }