{ "type": "bundle", "id": "bundle--58b87da8-48a4-4d5a-aac4-6a4902de0b81", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--58b87da8-48a4-4d5a-aac4-6a4902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "name": "OSINT - Covert Channels and Poor Decisions: The Tale of DNSMessenger", "published": "2017-03-02T20:28:06Z", "object_refs": [ "observed-data--58b87db6-8774-454e-ab1a-2dd902de0b81", "url--58b87db6-8774-454e-ab1a-2dd902de0b81", "x-misp-attribute--58b87df0-5704-44fe-b7d4-6a4602de0b81", "indicator--58b87e78-26c4-4fa2-a480-8f4002de0b81", "indicator--58b87e79-0958-4a3f-968e-8f4002de0b81", "indicator--58b87e79-24f4-4105-b0a4-8f4002de0b81", "indicator--58b87e7a-a9f0-4a9a-9f4d-8f4002de0b81", "indicator--58b87e7b-5108-48c3-b27f-8f4002de0b81", "indicator--58b87e7c-0ef0-46b1-940c-8f4002de0b81", "indicator--58b87e7d-ee4c-4054-81c5-8f4002de0b81", "indicator--58b87e7d-08c8-4a2d-96cc-8f4002de0b81", "indicator--58b87e7e-73f4-4cff-b172-8f4002de0b81", "indicator--58b87e7f-a214-44a6-aae4-8f4002de0b81", "indicator--58b87e80-3d70-4f37-a57d-8f4002de0b81", "indicator--58b87e81-5be8-46fc-99e2-8f4002de0b81", "indicator--58b87e81-de60-44f5-85e5-8f4002de0b81", "indicator--58b87e82-c338-48bd-b4a7-8f4002de0b81", "indicator--58b87e83-e494-46c4-bf87-8f4002de0b81", "indicator--58b87e84-2964-4fe4-8d8a-8f4002de0b81", "indicator--58b87e84-7590-45f7-8a16-8f4002de0b81", "indicator--58b87e85-23e8-401c-97b1-8f4002de0b81", "indicator--58b87e86-4410-4101-b9e8-8f4002de0b81", "indicator--58b87e87-4ddc-4d91-b1ae-8f4002de0b81", "indicator--58b87e88-b9b0-4965-ab9d-8f4002de0b81", "indicator--58b87e89-1588-449c-b7a8-8f4002de0b81", "indicator--58b87e8a-21f0-4663-b163-8f4002de0b81", "indicator--58b87e8a-0674-4903-bb8c-8f4002de0b81", "indicator--58b87e8b-b7e0-400d-a030-8f4002de0b81", "indicator--58b87e8c-67a4-4b8e-b84c-8f4002de0b81", "indicator--58b87e8d-35e8-4980-b3f3-8f4002de0b81", "indicator--58b87e8e-9db8-4954-8f57-8f4002de0b81", "indicator--58b87e8f-2cb0-480f-9869-8f4002de0b81", "indicator--58b87e8f-861c-43b8-ad24-8f4002de0b81", "indicator--58b87e90-3cdc-417c-b4e5-8f4002de0b81", "indicator--58b87e91-a690-4963-a30b-8f4002de0b81", "indicator--58b87e92-25b4-47cd-8982-8f4002de0b81", "indicator--58b87e93-86ac-47b7-9dd4-8f4002de0b81", "indicator--58b87e93-97fc-464a-9bbf-8f4002de0b81", "indicator--58b87e94-58f8-493e-a144-8f4002de0b81", "indicator--58b87e95-f168-48e2-b43b-8f4002de0b81", "indicator--58b87e96-5248-4011-a7c8-8f4002de0b81", "indicator--58b87e97-3d70-4e71-92b7-8f4002de0b81", "indicator--58b87e97-aeec-4ffe-83eb-8f4002de0b81", "indicator--58b87e98-68a0-4b0b-b491-8f4002de0b81", "indicator--58b87e99-fba8-4faa-b4d0-8f4002de0b81", "indicator--58b87e9a-c284-456c-aa81-8f4002de0b81", "indicator--58b87e9b-cfa4-4fe2-b0e8-8f4002de0b81", "indicator--58b87e9b-877c-4cec-ae71-8f4002de0b81", "indicator--58b87e9c-38b0-4ca0-8d8f-8f4002de0b81", "indicator--58b87e9d-74a0-48a5-b2d6-8f4002de0b81", "indicator--58b87e9e-d600-4f19-a550-8f4002de0b81", "indicator--58b87e9e-61f0-4771-9821-8f4002de0b81", "indicator--58b87e9f-cb2c-4a1b-9bbe-8f4002de0b81", "indicator--58b87ea0-d238-46f9-80bb-8f4002de0b81", "indicator--58b87ea1-6560-4f24-b0b8-8f4002de0b81", "indicator--58b87ea2-4a08-41dd-9c2c-8f4002de0b81", "indicator--58b87ea2-0c50-471f-8b4d-8f4002de0b81", "indicator--58b87ea3-73a4-4c2f-a34b-8f4002de0b81", "indicator--58b87ea4-e380-4d3d-9277-8f4002de0b81", "indicator--58b87ea5-a9b0-45f8-8cda-8f4002de0b81", "indicator--58b87ea5-da44-4ac9-87a0-8f4002de0b81", "indicator--58b87ea6-a0d8-4a90-958f-8f4002de0b81", "indicator--58b87ea7-b008-4bb4-80b4-8f4002de0b81", "indicator--58b87ea8-0db8-4112-857a-8f4002de0b81", "indicator--58b87ea8-9980-4a6c-ace8-8f4002de0b81", "indicator--58b87ea9-225c-4a77-992d-8f4002de0b81", "indicator--58b87eaa-9944-4f95-aecf-8f4002de0b81", "indicator--58b87eab-9d14-48fe-b3f7-8f4002de0b81", "indicator--58b87eab-d524-4fca-a7a7-8f4002de0b81", "indicator--58b87eac-2c28-4ec3-9f3f-8f4002de0b81", "indicator--58b87ead-59f4-480d-87ca-8f4002de0b81", "indicator--58b87eae-d0fc-4dbe-8a51-8f4002de0b81", "indicator--58b87eaf-3988-4424-a389-8f4002de0b81", "indicator--58b87eaf-a818-4b93-b966-8f4002de0b81", "indicator--58b87eb0-0ebc-4bcc-a66e-8f4002de0b81", "indicator--58b87eb1-15ec-4357-bc6d-8f4002de0b81", "indicator--58b87eb2-c7a8-4cd1-ac01-8f4002de0b81", "indicator--58b87eb2-3610-42df-bbdd-8f4002de0b81", "indicator--58b87eb3-c584-4fe6-b141-8f4002de0b81", "indicator--58b87eb4-dfa4-4e06-85c6-8f4002de0b81", "indicator--58b87eb5-1138-4f3c-8f7f-8f4002de0b81", "indicator--58b87eb6-950c-4a97-b42a-8f4002de0b81", "indicator--58b87eb6-4c24-4321-a77b-8f4002de0b81", "indicator--58b87eb7-38cc-453c-832e-8f4002de0b81", "indicator--58b87eb8-b2c0-4214-8c65-8f4002de0b81", "indicator--58b87eb9-6d38-405d-b05d-8f4002de0b81", "indicator--58b87eb9-d8a8-4753-89a9-8f4002de0b81", "indicator--58b87eba-8b4c-4608-a395-8f4002de0b81", "indicator--58b87ebb-7b9c-4e79-a1b5-8f4002de0b81", "indicator--58b87ebc-5564-48af-9304-8f4002de0b81", "indicator--58b87ebc-4aec-4a49-a5a0-8f4002de0b81", "indicator--58b87ebd-347c-4a05-9d2c-8f4002de0b81", "indicator--58b87ebe-ce74-4024-a4eb-8f4002de0b81", "indicator--58b87ebf-f4e8-4a83-9cd8-8f4002de0b81", "indicator--58b87ec0-d6b0-42d4-9fbb-8f4002de0b81", "indicator--58b87ec0-42a4-4aa0-b97d-8f4002de0b81", "indicator--58b87ec1-1064-46cf-a8d5-8f4002de0b81", "indicator--58b87ec2-5ed0-4a32-bd1e-8f4002de0b81", "indicator--58b87ec3-f038-4ef5-90b8-8f4002de0b81", "indicator--58b87ec3-d94c-4d9b-82f7-8f4002de0b81", "indicator--58b87ec4-382c-4a96-86cd-8f4002de0b81", "indicator--58b87ec5-ff3c-4686-ba6e-8f4002de0b81", "indicator--58b87ec6-bce8-4e91-a37b-8f4002de0b81", "indicator--58b87ec6-71f4-4112-9c60-8f4002de0b81", "indicator--58b87ec7-61c4-4800-a823-8f4002de0b81", "indicator--58b87ec8-aecc-4f47-b6c6-8f4002de0b81", "indicator--58b87ec9-eb9c-4d2b-ae64-8f4002de0b81", "indicator--58b87eca-1754-4592-aa90-8f4002de0b81", "indicator--58b87eca-23bc-41ce-ba8e-8f4002de0b81", "indicator--58b87eea-829c-4521-b0e5-40a602de0b81", "indicator--58b87eea-3e70-4b6e-b1db-4cca02de0b81", "indicator--58b87eeb-7138-493f-bb6b-4deb02de0b81", "indicator--58b87eec-29c8-4475-aecc-4fd602de0b81", "indicator--58b87eed-ba54-4625-a560-4c1602de0b81", "indicator--58b87eee-0408-450a-ab00-40fe02de0b81", "indicator--58b87eee-a180-45b6-bad1-464b02de0b81", "indicator--58b87eef-411c-471f-9770-485f02de0b81", "indicator--58b87f91-bc74-4999-b3c5-6a4902de0b81", "indicator--58b87f92-5c4c-45ca-85a5-6a4902de0b81", "observed-data--58b87f93-8fec-42ec-9055-6a4902de0b81", "url--58b87f93-8fec-42ec-9055-6a4902de0b81" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--58b87db6-8774-454e-ab1a-2dd902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "first_observed": "2017-03-02T20:24:53Z", "last_observed": "2017-03-02T20:24:53Z", "number_observed": 1, "object_refs": [ "url--58b87db6-8774-454e-ab1a-2dd902de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"", "admiralty-scale:source-reliability=\"b\"", "osint:source-type=\"blog-post\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "url", "spec_version": "2.1", "id": "url--58b87db6-8774-454e-ab1a-2dd902de0b81", "value": "http://blog.talosintelligence.com/2017/03/dnsmessenger.html" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--58b87df0-5704-44fe-b7d4-6a4602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"", "admiralty-scale:source-reliability=\"b\"", "osint:source-type=\"blog-post\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ], "x_misp_category": "External analysis", "x_misp_type": "text", "x_misp_value": "The Domain Name System (DNS) is one of the most commonly used Internet application protocols on corporate networks. It is responsible for providing name resolution so that network resources can be accessed by name, rather than requiring users to memorize IP addresses. While many organizations implement strict egress filtering as it pertains to web traffic, firewall rules, etc. many have less stringent controls in place to protect against DNS based threats. Attackers have recognized this and commonly encapsulate different network protocols within DNS to evade security devices.\r\n\r\nTypically this use of DNS is related to the exfiltration of information. Talos recently analyzed an interesting malware sample that made use of DNS TXT record queries and responses to create a bidirectional Command and Control (C2) channel. This allows the attacker to use DNS communications to submit new commands to be run on infected machines and return the results of the command execution to the attacker. This is an extremely uncommon and evasive way of administering a RAT. The use of multiple stages of Powershell with various stages being completely fileless indicates an attacker who has taken significant measures to avoid detection." }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e78-26c4-4fa2-a480-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'algew.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e79-0958-4a3f-968e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'aloqd.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e79-24f4-4105-b0a4-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'bpee.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7a-a9f0-4a9a-9f4d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'bvyv.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7b-5108-48c3-b27f-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'bwuk.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7c-0ef0-46b1-940c-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'cgqy.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7d-ee4c-4054-81c5-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'cihr.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7d-08c8-4a2d-96cc-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ckwl.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7e-73f4-4cff-b172-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'cnmah.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e7f-a214-44a6-aae4-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'coec.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e80-3d70-4f37-a57d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'cuuo.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e81-5be8-46fc-99e2-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'daskd.me']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e81-de60-44f5-85e5-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'dbxa.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e82-c338-48bd-b4a7-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'dlex.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e83-e494-46c4-bf87-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'doof.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e84-2964-4fe4-8d8a-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'dtxf.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e84-7590-45f7-8a16-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'dvso.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e85-23e8-401c-97b1-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'dyiud.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e86-4410-4101-b9e8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'eady.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e87-4ddc-4d91-b1ae-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'enuv.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e88-b9b0-4965-ab9d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'eter.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e89-1588-449c-b7a8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'fbjz.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8a-21f0-4663-b163-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'fhyi.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8a-0674-4903-bb8c-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'futh.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8b-b7e0-400d-a030-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'gjcu.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8c-67a4-4b8e-b84c-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'gjuc.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8d-35e8-4980-b3f3-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'gnoa.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8e-9db8-4954-8f57-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'grij.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8f-2cb0-480f-9869-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'gxhp.top']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e8f-861c-43b8-ad24-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'hvzr.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e90-3cdc-417c-b4e5-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'idjb.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e91-a690-4963-a30b-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ihrs.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e92-25b4-47cd-8982-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'jimw.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e93-86ac-47b7-9dd4-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'jomp.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e93-97fc-464a-9bbf-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'jxhv.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e94-58f8-493e-a144-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'kjke.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e95-f168-48e2-b43b-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'kshv.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e96-5248-4011-a7c8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'kwoe.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e97-3d70-4e71-92b7-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ldzp.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e97-aeec-4ffe-83eb-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'lhlv.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e98-68a0-4b0b-b491-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'lnoy.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e99-fba8-4faa-b4d0-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'lvrm.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9a-c284-456c-aa81-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'lvxf.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9b-cfa4-4fe2-b0e8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mewt.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9b-877c-4cec-ae71-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mfka.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9c-38b0-4ca0-8d8f-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mjet.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9d-74a0-48a5-b2d6-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mjut.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9e-d600-4f19-a550-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mvze.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9e-61f0-4771-9821-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'mxfg.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87e9f-cb2c-4a1b-9bbe-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'nroq.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea0-d238-46f9-80bb-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'nwrr.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea1-6560-4f24-b0b8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'nxpu.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea2-4a08-41dd-9c2c-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'oaax.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea2-0c50-471f-8b4d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'odwf.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea3-73a4-4c2f-a34b-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'odyr.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea4-e380-4d3d-9277-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'okiq.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea5-a9b0-45f8-8cda-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'oknz.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea5-da44-4ac9-87a0-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ooep.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea6-a0d8-4a90-958f-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ooyh.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea7-b008-4bb4-80b4-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'otzd.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea8-0db8-4112-857a-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'oxrp.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea8-9980-4a6c-ace8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'oyaw.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ea9-225c-4a77-992d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'pafk.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eaa-9944-4f95-aecf-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'palj.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eab-9d14-48fe-b3f7-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'pbbk.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eab-d524-4fca-a7a7-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ppdx.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eac-2c28-4ec3-9f3f-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'pvze.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ead-59f4-480d-87ca-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'qefg.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eae-d0fc-4dbe-8a51-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'qlpa.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eaf-3988-4424-a389-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'qznm.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eaf-a818-4b93-b966-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'reld.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb0-0ebc-4bcc-a66e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'rnkj.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb1-15ec-4357-bc6d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'rzzc.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb2-c7a8-4cd1-ac01-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'sgvt.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb2-3610-42df-bbdd-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'soru.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb3-c584-4fe6-b141-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'swio.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb4-dfa4-4e06-85c6-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'tijm.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb5-1138-4f3c-8f7f-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'tsrs.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb6-950c-4a97-b42a-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'turp.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb6-4c24-4321-a77b-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ueox.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb7-38cc-453c-832e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ufyb.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb8-b2c0-4214-8c65-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'utca.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb9-6d38-405d-b05d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vdfe.site']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eb9-d8a8-4753-89a9-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vjro.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eba-8b4c-4608-a395-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vkpo.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebb-7b9c-4e79-a1b5-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vpua.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebc-5564-48af-9304-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vqba.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebc-4aec-4a49-a5a0-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vwcq.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebd-347c-4a05-9d2c-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vxqt.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebe-ce74-4024-a4eb-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'vxwy.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ebf-f4e8-4a83-9cd8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'wfsv.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec0-d6b0-42d4-9fbb-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'wqiy.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec0-42a4-4aa0-b97d-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'wvzu.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec1-1064-46cf-a8d5-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'xhqd.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec2-5ed0-4a32-bd1e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'yamd.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec3-f038-4ef5-90b8-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'yedq.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec3-d94c-4d9b-82f7-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'yqox.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec4-382c-4a96-86cd-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'ysxy.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec5-ff3c-4686-ba6e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zcnt.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec6-bce8-4e91-a37b-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zdqp.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec6-71f4-4112-9c60-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zjav.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec7-61c4-4800-a823-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zjvz.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec8-aecc-4f47-b6c6-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zmyo.club']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87ec9-eb9c-4d2b-ae64-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zody.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eca-1754-4592-aa90-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'zugh.us']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eca-23bc-41ce-ba8e-8f4002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "description": "C2 Domains:", "pattern": "[domain-name:value = 'cspg.pw']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eea-829c-4521-b0e5-40a602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = 'f9e54609f1f4136da71dbab8f57c2e68e84bcdc32a58cc12ad5f86334ac0eacf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eea-3e70-4b6e-b1db-4cca02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = 'f82baa39ba44d9b356eb5d904917ad36446083f29dced8c5b34454955da89174']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eeb-7138-493f-bb6b-4deb02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = '340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eec-29c8-4475-aecc-4fd602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = '7f0a314f15a6f20ca6dced545fbc9ef8c1634f9ff8eb736deab73e46ae131458']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eed-ba54-4625-a560-4c1602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = 'be5f4bfa35fc1b350d38d8ddc8e88d2dd357b84f254318b1f3b07160c3900750']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eee-0408-450a-ab00-40fe02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = '9b955d9d7f62d405da9cf05425c9b6dd3738ce09160c8a75d396a6de229d9dd7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eee-a180-45b6-bad1-464b02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = 'fd6e7fc11a325c498d73cf683ecbe90ddbf0e1ae1d540b811012bd6980eed882']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87eef-411c-471f-9770-485f02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:53.000Z", "modified": "2017-03-02T20:24:53.000Z", "pattern": "[file:hashes.SHA256 = '6bf9d311ed16e059f9538b4c24c836cf421cf5c0c1f756fdfdeb9e1792ada8ba']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87f91-bc74-4999-b3c5-6a4902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:49.000Z", "modified": "2017-03-02T20:24:49.000Z", "description": "- Xchecked via VT: 340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981", "pattern": "[file:hashes.SHA1 = 'd00225d485c597bea712e7c7baa4fba7d7f281e3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:49Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--58b87f92-5c4c-45ca-85a5-6a4902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:50.000Z", "modified": "2017-03-02T20:24:50.000Z", "description": "- Xchecked via VT: 340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981", "pattern": "[file:hashes.MD5 = '2abad0ae32dd72bac5da0af1e580a2eb']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2017-03-02T20:24:50Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--58b87f93-8fec-42ec-9055-6a4902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2017-03-02T20:24:51.000Z", "modified": "2017-03-02T20:24:51.000Z", "first_observed": "2017-03-02T20:24:51Z", "last_observed": "2017-03-02T20:24:51Z", "number_observed": 1, "object_refs": [ "url--58b87f93-8fec-42ec-9055-6a4902de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--58b87f93-8fec-42ec-9055-6a4902de0b81", "value": "https://www.virustotal.com/file/340795d1f2c2bdab1f2382188a7b5c838e0a79d3f059d2db9eb274b0205f6981/analysis/1488479981/" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }