{ "type": "bundle", "id": "bundle--59db9d5b-e49c-455a-8a95-409c950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:47.000Z", "modified": "2017-10-12T18:16:47.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--59db9d5b-e49c-455a-8a95-409c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:47.000Z", "modified": "2017-10-12T18:16:47.000Z", "name": "M2M - Locky 2017-10-09 : Affid=3, offline, \".ykcol\" : \"Invoice IP1234567\" - \"Invoice-IP1234567.7z\"", "published": "2017-10-12T18:19:00Z", "object_refs": [ "indicator--59db9d5c-2b14-40eb-98f7-48c2950d210f", "indicator--59db9d5c-520c-4c2a-8c08-4a3f950d210f", "observed-data--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "indicator--59db9d5d-ba60-4133-9603-4370950d210f", "indicator--59db9d7b-9c24-4bda-8762-4a47950d210f", "observed-data--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "indicator--59db9d7d-7820-4796-8224-4c66950d210f", "indicator--59db9d7d-7a84-4eb3-bf75-433c950d210f", "observed-data--59db9d7d-725c-4cdf-8788-4eaf950d210f", "network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f", "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f", "indicator--59db9d7e-5584-42e8-a96f-4871950d210f", "indicator--59db9d7e-7f14-4d00-8cec-4fc9950d210f", "observed-data--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "indicator--59db9d7f-f344-47e2-b9e0-4037950d210f", "indicator--59db9d7f-7b48-455d-849d-4d3f950d210f", "observed-data--59db9d7f-4518-44ac-9fe8-4d30950d210f", "network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f", "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f", "indicator--59db9d80-b1ac-4230-a87d-4eb3950d210f", "indicator--59db9d80-49e8-4c87-924c-47e7950d210f", "observed-data--59db9d80-57e0-4069-b822-468c950d210f", "network-traffic--59db9d80-57e0-4069-b822-468c950d210f", "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f", "indicator--59db9d80-ef58-47c1-b2b5-4003950d210f", "indicator--59db9d81-2bf0-422e-a21e-44a3950d210f", "observed-data--59db9d81-5388-4ff0-bfd2-4660950d210f", "network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f", "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f", "indicator--59db9d81-fbac-4650-929b-46d4950d210f", "indicator--59db9d82-ad64-41b4-bd80-4d40950d210f", "observed-data--59db9d82-3874-4e0a-b6df-46f9950d210f", "network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f", "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f", "indicator--59db9d82-3928-4d1e-8190-4f74950d210f", "indicator--59db9d82-d3d0-4b4f-8deb-4a09950d210f", "observed-data--59db9d83-df20-4a3f-b834-4009950d210f", "network-traffic--59db9d83-df20-4a3f-b834-4009950d210f", "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f", "indicator--59db9d83-9660-44c4-a5eb-475f950d210f", "indicator--59db9d83-af84-4437-a220-4089950d210f", "observed-data--59db9d84-987c-4a74-949d-47a1950d210f", "network-traffic--59db9d84-987c-4a74-949d-47a1950d210f", "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f", "indicator--59db9d84-a5d0-4145-b1a1-47a8950d210f", "indicator--59db9d84-0cb0-4886-bc4d-4232950d210f", "observed-data--59db9d84-5cd4-4831-ae61-4f7a950d210f", "network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f", "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f", "indicator--59db9d85-9c8c-4ca1-a5dd-43c7950d210f", "indicator--59db9d85-2c80-48f7-8d71-4e64950d210f", "observed-data--59db9d85-cc1c-4821-9041-48ce950d210f", "network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f", "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f", "indicator--59db9d85-3da0-44d3-b1de-442c950d210f", "indicator--59db9d85-0980-4dd6-9a4c-47e3950d210f", "observed-data--59db9d86-ccb0-45b7-8767-40e1950d210f", "network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f", "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f", "indicator--59db9d86-bebc-46fa-bdc3-4f45950d210f", "indicator--59db9d86-7fc8-4869-805e-4d91950d210f", "observed-data--59db9d87-838c-4401-b045-425f950d210f", "network-traffic--59db9d87-838c-4401-b045-425f950d210f", "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f", "indicator--59db9d87-51f4-48ca-bd67-48ee950d210f", "indicator--59db9d87-c4c8-41a5-8098-4828950d210f", "observed-data--59db9d88-dc04-4ce8-8595-4ba6950d210f", "network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f", "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f", "indicator--59db9d88-2c68-447b-85d2-4b7a950d210f", "indicator--59db9d88-af3c-414f-b15c-45e4950d210f", "observed-data--59db9d88-e754-4d1d-9b2f-481c950d210f", "network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f", "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f", "indicator--59db9d89-8d5c-44ed-9f02-4e1d950d210f", "indicator--59db9d89-6ae0-480f-9ba2-4be4950d210f", "observed-data--59db9d89-0e0c-4599-8045-402e950d210f", "network-traffic--59db9d89-0e0c-4599-8045-402e950d210f", "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f", "indicator--59db9d8a-6720-45ba-8c82-4465950d210f", "indicator--59db9d8a-6c58-47b5-86f4-4cb5950d210f", "observed-data--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "indicator--59db9d8a-a474-4386-9530-4a2a950d210f", "indicator--59db9d8b-a250-408e-bc24-4c9c950d210f", "observed-data--59db9d8b-eee8-43db-99cb-4d43950d210f", "network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f", "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f", "indicator--59db9d8b-0ab4-4315-b0b8-475e950d210f", "indicator--59db9d8b-fae8-4dee-b698-4831950d210f", "observed-data--59db9d8c-4968-46ad-b5a5-42eb950d210f", "network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f", "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f", "indicator--59db9d8c-b070-4a61-9216-471a950d210f", "indicator--59db9d8c-2ae8-4c15-8796-436c950d210f", "observed-data--59db9d8d-d3a8-4313-a775-4abf950d210f", "network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f", "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f", "indicator--59db9d8d-efd0-47d3-886f-4f62950d210f", "indicator--59db9d8d-7884-410e-9e8b-4706950d210f", "observed-data--59db9d8d-a970-47e4-bf54-49ec950d210f", "network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f", "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f", "indicator--59db9d8e-13f8-4d72-997a-4ca7950d210f", "indicator--59dfb16f-79d4-4108-a8de-48a402de0b81", "indicator--59dfb16f-d15c-4a16-8a9d-418202de0b81", "observed-data--59dfb16f-043c-4b3d-8724-428c02de0b81", "url--59dfb16f-043c-4b3d-8724-428c02de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "ecsirt:malicious-code=\"ransomware\"", "misp-galaxy:ransomware=\"Locky\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d5c-2b14-40eb-98f7-48c2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[file:hashes.MD5 = '3aeeb55f8239b731603f5c907113a34f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d5c-520c-4c2a-8c08-4a3f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'mail.estudiorrbp.com.uy']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "dst_ref": "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d5d-48e0-4ac8-8e90-47fd950d210f", "value": "50.63.177.206" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d5d-ba60-4133-9603-4370950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'scottfranch.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7b-9c24-4bda-8762-4a47950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'essenza.co.id']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "dst_ref": "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d7d-2a48-4c7b-aa72-4d9d950d210f", "value": "202.169.44.141" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7d-7820-4796-8224-4c66950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://121-psychic-reading.co.uk/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7d-7a84-4eb3-bf75-433c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = '121-psychic-reading.co.uk']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d7d-725c-4cdf-8788-4eaf950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f", "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d7d-725c-4cdf-8788-4eaf950d210f", "dst_ref": "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d7d-725c-4cdf-8788-4eaf950d210f", "value": "217.168.155.63" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7e-5584-42e8-a96f-4871950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://amatuermatch.org/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7e-7f14-4d00-8cec-4fc9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'amatuermatch.org']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "dst_ref": "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d7f-ae0c-49dd-ad8b-49b3950d210f", "value": "64.50.172.171" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7f-f344-47e2-b9e0-4037950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://anderlaw.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d7f-7b48-455d-849d-4d3f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'anderlaw.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d7f-4518-44ac-9fe8-4d30950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f", "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d7f-4518-44ac-9fe8-4d30950d210f", "dst_ref": "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d7f-4518-44ac-9fe8-4d30950d210f", "value": "98.124.251.69" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d80-b1ac-4230-a87d-4eb3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://asesoreszapico.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d80-49e8-4c87-924c-47e7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'asesoreszapico.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d80-57e0-4069-b822-468c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d80-57e0-4069-b822-468c950d210f", "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d80-57e0-4069-b822-468c950d210f", "dst_ref": "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d80-57e0-4069-b822-468c950d210f", "value": "212.89.16.142" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d80-ef58-47c1-b2b5-4003950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://cagliaricity.it/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d81-2bf0-422e-a21e-44a3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'cagliaricity.it']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d81-5388-4ff0-bfd2-4660950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f", "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d81-5388-4ff0-bfd2-4660950d210f", "dst_ref": "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d81-5388-4ff0-bfd2-4660950d210f", "value": "95.110.196.214" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d81-fbac-4650-929b-46d4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://cfai66.fr/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d82-ad64-41b4-bd80-4d40950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'cfai66.fr']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d82-3874-4e0a-b6df-46f9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f", "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d82-3874-4e0a-b6df-46f9950d210f", "dst_ref": "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d82-3874-4e0a-b6df-46f9950d210f", "value": "87.252.5.144" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d82-3928-4d1e-8190-4f74950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://depomedikal.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d82-d3d0-4b4f-8deb-4a09950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'depomedikal.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d83-df20-4a3f-b834-4009950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d83-df20-4a3f-b834-4009950d210f", "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d83-df20-4a3f-b834-4009950d210f", "dst_ref": "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d83-df20-4a3f-b834-4009950d210f", "value": "82.151.131.234" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d83-9660-44c4-a5eb-475f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://designordie.ca/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d83-af84-4437-a220-4089950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'designordie.ca']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d84-987c-4a74-949d-47a1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d84-987c-4a74-949d-47a1950d210f", "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d84-987c-4a74-949d-47a1950d210f", "dst_ref": "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d84-987c-4a74-949d-47a1950d210f", "value": "204.244.185.219" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d84-a5d0-4145-b1a1-47a8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://dewekker.nl/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d84-0cb0-4886-bc4d-4232950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'dewekker.nl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d84-5cd4-4831-ae61-4f7a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f", "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d84-5cd4-4831-ae61-4f7a950d210f", "dst_ref": "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d84-5cd4-4831-ae61-4f7a950d210f", "value": "94.126.70.12" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d85-9c8c-4ca1-a5dd-43c7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://domke-engineering.de/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d85-2c80-48f7-8d71-4e64950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'domke-engineering.de']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d85-cc1c-4821-9041-48ce950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f", "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d85-cc1c-4821-9041-48ce950d210f", "dst_ref": "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d85-cc1c-4821-9041-48ce950d210f", "value": "213.185.128.116" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d85-3da0-44d3-b1de-442c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://drspay.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d85-0980-4dd6-9a4c-47e3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'drspay.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d86-ccb0-45b7-8767-40e1950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f", "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d86-ccb0-45b7-8767-40e1950d210f", "dst_ref": "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d86-ccb0-45b7-8767-40e1950d210f", "value": "68.178.159.168" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d86-bebc-46fa-bdc3-4f45950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://easyhousedev.gr/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d86-7fc8-4869-805e-4d91950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'easyhousedev.gr']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d87-838c-4401-b045-425f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d87-838c-4401-b045-425f950d210f", "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d87-838c-4401-b045-425f950d210f", "dst_ref": "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d87-838c-4401-b045-425f950d210f", "value": "149.56.223.252" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d87-51f4-48ca-bd67-48ee950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://ecotek.me/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d87-c4c8-41a5-8098-4828950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[domain-name:value = 'ecotek.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d88-dc04-4ce8-8595-4ba6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "first_observed": "2017-10-12T18:16:14Z", "last_observed": "2017-10-12T18:16:14Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f", "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d88-dc04-4ce8-8595-4ba6950d210f", "dst_ref": "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d88-dc04-4ce8-8595-4ba6950d210f", "value": "45.40.135.32" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d88-2c68-447b-85d2-4b7a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:14.000Z", "modified": "2017-10-12T18:16:14.000Z", "pattern": "[url:value = 'http://edeldestillerie-mair.at/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d88-af3c-414f-b15c-45e4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'edeldestillerie-mair.at']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d88-e754-4d1d-9b2f-481c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f", "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d88-e754-4d1d-9b2f-481c950d210f", "dst_ref": "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d88-e754-4d1d-9b2f-481c950d210f", "value": "193.19.92.233" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d89-8d5c-44ed-9f02-4e1d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://hard-grooves.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d89-6ae0-480f-9ba2-4be4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'hard-grooves.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d89-0e0c-4599-8045-402e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d89-0e0c-4599-8045-402e950d210f", "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d89-0e0c-4599-8045-402e950d210f", "dst_ref": "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d89-0e0c-4599-8045-402e950d210f", "value": "66.36.173.111" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8a-6720-45ba-8c82-4465950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://hellonwheelsthemovie.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8a-6c58-47b5-86f4-4cb5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'hellonwheelsthemovie.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "dst_ref": "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d8a-c4fc-4ce7-aadc-42ad950d210f", "value": "66.36.165.149" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8a-a474-4386-9530-4a2a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://intra.cfecgcaquitaine.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8b-a250-408e-bc24-4c9c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'intra.cfecgcaquitaine.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d8b-eee8-43db-99cb-4d43950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f", "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d8b-eee8-43db-99cb-4d43950d210f", "dst_ref": "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d8b-eee8-43db-99cb-4d43950d210f", "value": "94.247.178.77" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8b-0ab4-4315-b0b8-475e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://miyatakewind.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8b-fae8-4dee-b698-4831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'miyatakewind.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d8c-4968-46ad-b5a5-42eb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f", "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d8c-4968-46ad-b5a5-42eb950d210f", "dst_ref": "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d8c-4968-46ad-b5a5-42eb950d210f", "value": "216.194.66.48" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8c-b070-4a61-9216-471a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://prova.eshopavant.it/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8c-2ae8-4c15-8796-436c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'prova.eshopavant.it']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d8d-d3a8-4313-a775-4abf950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f", "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d8d-d3a8-4313-a775-4abf950d210f", "dst_ref": "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d8d-d3a8-4313-a775-4abf950d210f", "value": "217.73.227.30" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8d-efd0-47d3-886f-4f62950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://prueba.depaterna.com/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8d-7884-410e-9e8b-4706950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[domain-name:value = 'prueba.depaterna.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59db9d8d-a970-47e4-bf54-49ec950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f", "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--59db9d8d-a970-47e4-bf54-49ec950d210f", "dst_ref": "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--59db9d8d-a970-47e4-bf54-49ec950d210f", "value": "62.113.249.12" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59db9d8e-13f8-4d72-997a-4ca7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "pattern": "[url:value = 'http://scottfranch.org/p66/8734gf3hf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59dfb16f-79d4-4108-a8de-48a402de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f", "pattern": "[file:hashes.SHA256 = '203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--59dfb16f-d15c-4a16-8a9d-418202de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "description": "- Xchecked via VT: 3aeeb55f8239b731603f5c907113a34f", "pattern": "[file:hashes.SHA1 = '517c3203aed9a4229d6260a796f03e448250e0a3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-10-12T18:16:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--59dfb16f-043c-4b3d-8724-428c02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-10-12T18:16:15.000Z", "modified": "2017-10-12T18:16:15.000Z", "first_observed": "2017-10-12T18:16:15Z", "last_observed": "2017-10-12T18:16:15Z", "number_observed": 1, "object_refs": [ "url--59dfb16f-043c-4b3d-8724-428c02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--59dfb16f-043c-4b3d-8724-428c02de0b81", "value": "https://www.virustotal.com/file/203ee7bc02c3d2b01584efc23b5240fdbc37c56a99b17cef8983ff59f564ab18/analysis/1507550567/" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }