{ "type": "bundle", "id": "bundle--57f26f87-fbc8-4b7b-be64-6e88950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:38.000Z", "modified": "2016-10-04T04:38:38.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--57f26f87-fbc8-4b7b-be64-6e88950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:38.000Z", "modified": "2016-10-04T04:38:38.000Z", "name": "Malspam 2016-10-03 (.xls) - campaign: \"Invoice-\"", "published": "2016-10-04T04:40:04Z", "object_refs": [ "indicator--57f26f99-a1d0-483f-9894-4ece950d210f", "indicator--57f26f99-28fc-422c-a4be-4ad7950d210f", "indicator--57f26f9a-9c44-4e57-af82-42a0950d210f", "indicator--57f26f9a-e234-4e51-a6d4-4868950d210f", "indicator--57f26f9a-58b0-45f7-88f9-48df950d210f", "indicator--57f26f9a-0734-4dd7-844f-429e950d210f", "indicator--57f26f9b-7220-4b2b-b2eb-4da2950d210f", "indicator--57f26f9b-bba8-4346-bd7a-498d950d210f", "indicator--57f26f9b-35bc-4b0a-acb9-4b7b950d210f", "indicator--57f26f9b-23a0-46ce-b866-44bb950d210f", "indicator--57f26f9c-d7d0-451c-af97-4cc8950d210f", "indicator--57f26f9c-9270-426e-a603-45fb950d210f", "indicator--57f26f9c-72a8-432e-a33a-4fc7950d210f", "indicator--57f26f9c-fb3c-491f-a819-46f3950d210f", "indicator--57f26f9c-9f8c-4119-9e10-4288950d210f", "indicator--57f3324c-d3cc-4280-9357-4ff3950d210f", "indicator--57f3324c-3e04-4943-ba36-4735950d210f", "indicator--57f3324d-f228-4bb7-a0ae-4b33950d210f", "indicator--57f3324d-3624-40f8-89f6-4670950d210f", "indicator--57f3324d-3de4-48c9-8ad4-42dc950d210f", "indicator--57f3324d-ab00-4f64-97a1-4dc2950d210f", "indicator--57f3324e-ec8c-42a4-9a98-424d950d210f", "indicator--57f3324e-2518-41d7-9bf7-4590950d210f", "indicator--57f3324e-e388-4260-8424-40eb950d210f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "circl:incident-classification=\"malware\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f99-a1d0-483f-9894-4ece950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:53.000Z", "modified": "2016-10-03T14:47:53.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.240.2.32']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f99-28fc-422c-a4be-4ad7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:53.000Z", "modified": "2016-10-03T14:47:53.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.54.115.4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9a-9c44-4e57-af82-42a0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:54.000Z", "modified": "2016-10-03T14:47:54.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '208.71.139.66']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9a-e234-4e51-a6d4-4868950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:54.000Z", "modified": "2016-10-03T14:47:54.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '68.65.120.207']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9a-58b0-45f7-88f9-48df950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:54.000Z", "modified": "2016-10-03T14:47:54.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.42.218.173']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9a-0734-4dd7-844f-429e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:54.000Z", "modified": "2016-10-03T14:47:54.000Z", "description": "download location", "pattern": "[domain-name:value = 'acaciainvest.ro']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9b-7220-4b2b-b2eb-4da2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:55.000Z", "modified": "2016-10-03T14:47:55.000Z", "description": "download location", "pattern": "[domain-name:value = 'craftsreviews.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:55Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9b-bba8-4346-bd7a-498d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:55.000Z", "modified": "2016-10-03T14:47:55.000Z", "description": "download location", "pattern": "[domain-name:value = 'crossroadspd.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:55Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9b-35bc-4b0a-acb9-4b7b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:55.000Z", "modified": "2016-10-03T14:47:55.000Z", "description": "download location", "pattern": "[domain-name:value = 'golfnauvoo.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:55Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9b-23a0-46ce-b866-44bb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:55.000Z", "modified": "2016-10-03T14:47:55.000Z", "description": "download location", "pattern": "[url:value = 'http://acaciainvest.ro/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:55Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9c-d7d0-451c-af97-4cc8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:56.000Z", "modified": "2016-10-03T14:47:56.000Z", "description": "download location", "pattern": "[url:value = 'http://craftsreviews.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9c-9270-426e-a603-45fb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:56.000Z", "modified": "2016-10-03T14:47:56.000Z", "description": "download location", "pattern": "[url:value = 'http://crossroadspd.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9c-72a8-432e-a33a-4fc7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:56.000Z", "modified": "2016-10-03T14:47:56.000Z", "description": "download location", "pattern": "[url:value = 'http://golfnauvoo.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9c-fb3c-491f-a819-46f3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:56.000Z", "modified": "2016-10-03T14:47:56.000Z", "description": "download location", "pattern": "[url:value = 'http://icdsarch.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f26f9c-9f8c-4119-9e10-4288950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-03T14:47:56.000Z", "modified": "2016-10-03T14:47:56.000Z", "description": "download location", "pattern": "[domain-name:value = 'icdsarch.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-03T14:47:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324c-d3cc-4280-9357-4ff3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:36.000Z", "modified": "2016-10-04T04:38:36.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '212.48.80.241']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324c-3e04-4943-ba36-4735950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:36.000Z", "modified": "2016-10-04T04:38:36.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '95.173.189.63']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324d-f228-4bb7-a0ae-4b33950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:36.000Z", "modified": "2016-10-04T04:38:36.000Z", "description": "download location", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '96.0.130.2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324d-3624-40f8-89f6-4670950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:37.000Z", "modified": "2016-10-04T04:38:37.000Z", "description": "download location", "pattern": "[domain-name:value = 'alraysa.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324d-3de4-48c9-8ad4-42dc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:37.000Z", "modified": "2016-10-04T04:38:37.000Z", "description": "download location", "pattern": "[url:value = 'http://alraysa.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324d-ab00-4f64-97a1-4dc2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:37.000Z", "modified": "2016-10-04T04:38:37.000Z", "description": "download location", "pattern": "[url:value = 'http://ifsaiumumi.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324e-ec8c-42a4-9a98-424d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:38.000Z", "modified": "2016-10-04T04:38:38.000Z", "description": "download location", "pattern": "[url:value = 'http://maxleather.aaomg.com/jhg45s']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324e-2518-41d7-9bf7-4590950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:38.000Z", "modified": "2016-10-04T04:38:38.000Z", "description": "download location", "pattern": "[domain-name:value = 'ifsaiumumi.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57f3324e-e388-4260-8424-40eb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-10-04T04:38:38.000Z", "modified": "2016-10-04T04:38:38.000Z", "description": "download location", "pattern": "[domain-name:value = 'maxleather.aaomg.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-10-04T04:38:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }