{ "type": "bundle", "id": "bundle--5a0f0f64-4be0-4b9f-b6e3-5e08950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:58.000Z", "modified": "2017-11-17T16:44:58.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--5a0f0f64-4be0-4b9f-b6e3-5e08950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:58.000Z", "modified": "2017-11-17T16:44:58.000Z", "name": "M2M - Trickbot 2017-11-14 : \"mac1\" : \"Invoice\n AXBY1234567\" - \"InvoiceAXBY1234567.doc\"", "context": "suspicious-activity", "object_refs": [ "indicator--5a0f0f65-6728-417b-be96-b831950d210f", "indicator--5a0f0f65-e4a0-42ca-9876-5911950d210f", "indicator--5a0f0f65-96d4-4d8a-8978-4dfd950d210f", "observed-data--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "indicator--5a0f0f66-2ab8-4fc9-9500-b41d950d210f", "indicator--5a0f0f66-69f8-44b9-8975-b59f950d210f", "observed-data--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "indicator--5a0f0f67-e470-4ef3-9ec9-5e08950d210f", "indicator--5a0f0f67-e778-4c79-9bfc-5d86950d210f", "observed-data--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "indicator--5a0f0f67-d570-4688-b052-5d51950d210f", "indicator--5a0f0f67-d120-4b45-bc25-b831950d210f", "observed-data--5a0f0f68-9a20-4b25-8e06-5911950d210f", "network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f", "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f", "indicator--5a0f0f68-294c-492e-bb55-41c0950d210f", "indicator--5a0f0f68-dba0-41a1-9e33-5d86950d210f", "indicator--5a0f0f69-e044-4990-b068-b84a950d210f", "indicator--5a0f0f69-3fcc-4b0a-b0d1-5dfc950d210f", "observed-data--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "observed-data--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "observed-data--5a0f0f69-98e0-451d-971a-4f7c950d210f", "network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f", "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f", "observed-data--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "observed-data--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "observed-data--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "observed-data--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "observed-data--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "observed-data--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "observed-data--5a0f0f6b-b088-497e-9567-4af6950d210f", "network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f", "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f", "observed-data--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "observed-data--5a0f0f6c-d900-4741-8743-b59f950d210f", "network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f", "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f", "observed-data--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "observed-data--5a0f0f6d-7044-463b-824b-435c950d210f", "network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f", "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f", "observed-data--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "observed-data--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "observed-data--5a0f0f6d-a978-4233-80c2-4be7950d210f", "network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f", "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f", "observed-data--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "observed-data--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "observed-data--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "observed-data--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "observed-data--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "observed-data--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "observed-data--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "observed-data--5a0f0f70-5460-4687-a5af-5911950d210f", "network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f", "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f", "observed-data--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "observed-data--5a0f0f70-e560-4f6e-b847-5d86950d210f", "network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f", "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f", "observed-data--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "observed-data--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "observed-data--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "observed-data--5a0f0f71-19c0-42be-9da2-b831950d210f", "network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f", "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f", "indicator--5a0f1203-6b28-4acb-85ab-442602de0b81", "indicator--5a0f1203-defc-4085-8173-498a02de0b81", "observed-data--5a0f1203-5484-401a-955f-458102de0b81", "url--5a0f1203-5484-401a-955f-458102de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:tool=\"Trick Bot\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f65-6728-417b-be96-b831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[file:hashes.MD5 = '37e5976ed01f8bcf6b814e58a847d294']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f65-e4a0-42ca-9876-5911950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://hubalon.de/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f65-96d4-4d8a-8978-4dfd950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'hubalon.de']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "dst_ref": "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f66-9440-48cd-9f29-5dfc950d210f", "value": "212.72.171.130" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f66-2ab8-4fc9-9500-b41d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://infoweb.cfpsdevweb.ch/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f66-69f8-44b9-8975-b59f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'infoweb.cfpsdevweb.ch']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "dst_ref": "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f66-54f4-4c11-9a39-4bb6950d210f", "value": "213.221.153.22" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f67-e470-4ef3-9ec9-5e08950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://kb.schuttesystems.net/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f67-e778-4c79-9bfc-5d86950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'kb.schuttesystems.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "dst_ref": "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f67-e5a8-4d7e-a2f7-b84a950d210f", "value": "194.151.161.144" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f67-d570-4688-b052-5d51950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://kipshagen-ol.de/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f67-d120-4b45-bc25-b831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'kipshagen-ol.de']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f68-9a20-4b25-8e06-5911950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f", "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f68-9a20-4b25-8e06-5911950d210f", "dst_ref": "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f68-9a20-4b25-8e06-5911950d210f", "value": "82.165.155.25" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f68-294c-492e-bb55-41c0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://nc.skyrunner.net/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f68-dba0-41a1-9e33-5d86950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'nc.skyrunner.net']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f69-e044-4990-b068-b84a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[url:value = 'http://sport-market.ru/FGdhbr5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f0f69-3fcc-4b0a-b0d1-5dfc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "pattern": "[domain-name:value = 'sport-market.ru']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "dst_ref": "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f69-35f0-40cc-a98d-5d51950d210f", "value": "85.10.224.162" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "dst_ref": "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f69-ec94-4d52-9d5c-49f9950d210f", "value": "187.188.162.150" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f69-98e0-451d-971a-4f7c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f", "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f69-98e0-451d-971a-4f7c950d210f", "dst_ref": "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f69-98e0-451d-971a-4f7c950d210f", "value": "185.28.63.109" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "dst_ref": "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6a-c1b4-49f9-8981-4c40950d210f", "value": "83.0.245.234" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "dst_ref": "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6a-c9e0-493b-9f3b-b664950d210f", "value": "213.241.29.89" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "dst_ref": "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6a-7870-49b8-b63c-5e08950d210f", "value": "62.109.31.123" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "dst_ref": "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6b-b2b4-4d2d-910b-478c950d210f", "value": "92.63.107.14" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "dst_ref": "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6b-8f14-4ab5-90d7-45e5950d210f", "value": "92.63.107.222" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "dst_ref": "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6b-9f34-45a8-b704-b84a950d210f", "value": "92.63.104.211" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6b-b088-497e-9567-4af6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f", "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6b-b088-497e-9567-4af6950d210f", "dst_ref": "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6b-b088-497e-9567-4af6950d210f", "value": "62.109.25.3" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "dst_ref": "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6c-40c8-41f3-b245-b41d950d210f", "value": "62.109.26.208" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6c-d900-4741-8743-b59f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f", "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6c-d900-4741-8743-b59f950d210f", "dst_ref": "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6c-d900-4741-8743-b59f950d210f", "value": "37.230.113.231" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "dst_ref": "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6c-826c-46e5-92ef-47d0950d210f", "value": "149.154.69.126" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6d-7044-463b-824b-435c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f", "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6d-7044-463b-824b-435c950d210f", "dst_ref": "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6d-7044-463b-824b-435c950d210f", "value": "95.213.191.144" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "dst_ref": "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6d-42ec-48d3-ba9e-b664950d210f", "value": "82.202.226.229" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "dst_ref": "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6d-3ad4-4d30-9a78-5e08950d210f", "value": "37.230.113.249" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6d-a978-4233-80c2-4be7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f", "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6d-a978-4233-80c2-4be7950d210f", "dst_ref": "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6d-a978-4233-80c2-4be7950d210f", "value": "149.154.69.129" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "dst_ref": "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6e-f8b0-42f6-9fda-5d86950d210f", "value": "185.158.114.72" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "dst_ref": "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6e-0e80-49a7-9117-b84a950d210f", "value": "179.43.160.50" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "dst_ref": "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6e-875c-4fd4-bf89-4f23950d210f", "value": "94.250.254.22" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "dst_ref": "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6f-a384-474f-8c3b-5dfc950d210f", "value": "149.154.70.248" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "dst_ref": "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6f-f3b4-4c03-af17-5d51950d210f", "value": "95.213.236.81" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "dst_ref": "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6f-a67c-4df4-9c09-4aa2950d210f", "value": "82.202.226.66" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "dst_ref": "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f6f-49e0-4710-aa7f-b831950d210f", "value": "37.230.113.191" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f70-5460-4687-a5af-5911950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f", "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f70-5460-4687-a5af-5911950d210f", "dst_ref": "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f70-5460-4687-a5af-5911950d210f", "value": "92.53.67.44" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "dst_ref": "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f70-3f68-47ce-b9a7-446a950d210f", "value": "94.250.254.104" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f70-e560-4f6e-b847-5d86950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f", "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f70-e560-4f6e-b847-5d86950d210f", "dst_ref": "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f70-e560-4f6e-b847-5d86950d210f", "value": "91.211.247.94" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "dst_ref": "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f70-0d10-4e6e-9d1c-b57b950d210f", "value": "94.250.254.102" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "dst_ref": "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f71-d47c-4892-bd8f-b41d950d210f", "value": "185.34.52.80" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "dst_ref": "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f71-7ac8-4efb-a02b-4143950d210f", "value": "195.133.146.156" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f0f71-19c0-42be-9da2-b831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f", "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f" ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"" ] }, { "type": "network-traffic", "spec_version": "2.1", "id": "network-traffic--5a0f0f71-19c0-42be-9da2-b831950d210f", "dst_ref": "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f", "protocols": [ "tcp" ] }, { "type": "ipv4-addr", "spec_version": "2.1", "id": "ipv4-addr--5a0f0f71-19c0-42be-9da2-b831950d210f", "value": "77.244.215.81" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f1203-6b28-4acb-85ab-442602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "description": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294", "pattern": "[file:hashes.SHA256 = 'e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5a0f1203-defc-4085-8173-498a02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "description": "- Xchecked via VT: 37e5976ed01f8bcf6b814e58a847d294", "pattern": "[file:hashes.SHA1 = 'd4e18c53779b3900e325eda985f611eb50043703']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-11-17T16:44:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5a0f1203-5484-401a-955f-458102de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-11-17T16:44:51.000Z", "modified": "2017-11-17T16:44:51.000Z", "first_observed": "2017-11-17T16:44:51Z", "last_observed": "2017-11-17T16:44:51Z", "number_observed": 1, "object_refs": [ "url--5a0f1203-5484-401a-955f-458102de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5a0f1203-5484-401a-955f-458102de0b81", "value": "https://www.virustotal.com/file/e1217585c1c357a9cd4f44e54fd18e198f70e337d1e7073963adc270c5c7f526/analysis/1510816029/" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }