{ "type": "bundle", "id": "bundle--5b61a496-b034-4321-9406-e0330acd0835", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2020-12-09T14:44:29.000Z", "modified": "2020-12-09T14:44:29.000Z", "name": "Synovus Financial", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5b61a496-b034-4321-9406-e0330acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2020-12-09T14:44:29.000Z", "modified": "2020-12-09T14:44:29.000Z", "name": "Talos Blog: Multiple Cobalt Personality Disorder", "published": "2020-12-14T06:19:29Z", "object_refs": [ "observed-data--5b61a4a4-4d74-4c18-8d63-dab70acd0835", "url--5b61a4a4-4d74-4c18-8d63-dab70acd0835", "vulnerability--5b61a605-d6e8-46be-9308-dd5f0acd0835", "vulnerability--5b61a605-0744-4a88-9b28-dd5f0acd0835", "vulnerability--5b61a605-8784-4f8e-81b5-dd5f0acd0835", "vulnerability--5b61a605-c430-4b44-92a6-dd5f0acd0835", "indicator--5b61a657-dbb8-4b87-b7e9-ea300acd0835", "indicator--5b61a657-11d0-4c0b-887f-ea300acd0835", "indicator--5b61a657-5344-4e03-ae4f-ea300acd0835", "indicator--5b61a657-15a8-4917-9b25-ea300acd0835", "indicator--5b61a657-2f4c-4f41-9651-ea300acd0835", "indicator--5b61a657-fef8-414a-9fd0-ea300acd0835", "indicator--5b61a657-e54c-4cc0-b622-ea300acd0835", "indicator--5b61a657-dcd0-45ba-be79-ea300acd0835", "indicator--5b61a68c-1848-4dd4-8cf2-dd5f0acd0835", "indicator--5b61a68c-6d50-4a2e-bdb9-dd5f0acd0835", "indicator--5b61a68c-1b00-4519-95c7-dd5f0acd0835", "indicator--5b61a6a4-9704-4934-a3de-ecbf0acd0835", "indicator--5b61a6a4-f93c-4f07-87e5-ecbf0acd0835", "indicator--5b61a6a4-383c-4296-9023-ecbf0acd0835", "indicator--5b61a6a4-beb8-4ddf-a1f3-ecbf0acd0835", "indicator--5b61a6c0-b97c-42f6-a819-ecc80acd0835", "indicator--5b61a6c0-17a0-4ea2-be60-ecc80acd0835", "indicator--5b61a6c0-6384-4fee-a10d-ecc80acd0835", "indicator--5b61a6c0-4ad8-4e14-b6e1-ecc80acd0835", "indicator--5b61a6de-37c4-4869-ac92-ea300acd0835", "indicator--5b61a6de-3770-4d3d-989b-ea300acd0835", "indicator--5b61a6de-cf40-4492-a692-ea300acd0835", "indicator--5b61a6f6-cc20-40f6-8ae5-ecc80acd0835", "indicator--5b61a713-8f40-49b0-9c95-ecc80acd0835", "indicator--5b61a713-12f0-4607-8076-ecc80acd0835", "indicator--5b61a796-5f54-42e5-9d58-ed810acd0835", "indicator--5b61a796-a1d0-4c35-80ac-ed810acd0835", "indicator--5b61a796-7ed4-4d7b-9602-ed810acd0835", "indicator--5b61a796-103c-4dfb-b730-ed810acd0835", "indicator--5b61a7c6-df00-4cf5-b611-dd5f0acd0835", "indicator--5b61a7c6-ced4-48f5-9ac1-dd5f0acd0835", "indicator--5b61a7c6-7bfc-4d40-9980-dd5f0acd0835", "indicator--5b61a7c6-f6dc-4776-8aa3-dd5f0acd0835", "indicator--5b61a7c6-ebbc-4066-95ff-dd5f0acd0835", "indicator--5b61a7c6-d0d4-4ff2-b054-dd5f0acd0835", "indicator--5b61a7c6-cc5c-4d59-8114-dd5f0acd0835", "indicator--5b61a7c6-505c-4457-9367-dd5f0acd0835", "indicator--5b61a7c6-f0e0-41a6-b338-dd5f0acd0835", "indicator--5b61a7c6-bb0c-416f-a065-dd5f0acd0835", "indicator--5b61a7ec-1368-4a13-ab39-d5860acd0835", "indicator--5b61a7ec-9aac-4800-8196-d5860acd0835", "indicator--5b61a7ec-0eec-4a3e-b7eb-d5860acd0835", "indicator--5b61a7ec-576c-43e6-a597-d5860acd0835", "indicator--5b61a7ec-eb10-4845-94b0-d5860acd0835", "indicator--5b61a808-c654-420e-aac4-ea2c0acd0835", "indicator--5b61a808-74d8-4b61-86f5-ea2c0acd0835", "indicator--5b61a825-f9fc-4a4e-be81-f0ac0acd0835", "indicator--5b61a852-73a0-41e3-9a50-f0ac0acd0835", "x-misp-attribute--5b62fa2c-1be8-453f-be37-536fd5388438", "observed-data--5b62fa2c-0698-4e7d-9380-76b1d5388438", "url--5b62fa2c-0698-4e7d-9380-76b1d5388438", "x-misp-attribute--5b62fa2c-a150-4a9f-8180-711dd5388438", "x-misp-attribute--5b62fa2c-6c08-4672-8755-711cd5388438", "x-misp-attribute--5b62fa2c-764c-49f1-9d4c-5371d5388438", "x-misp-attribute--5b62fa2c-5288-4f56-bff2-5370d5388438", "x-misp-attribute--5b62fa2d-9724-4c15-bdcb-7a59d5388438", "x-misp-attribute--5b62fa2d-7b98-4f78-9fa3-7b2cd5388438", "x-misp-attribute--5b62fa2d-8128-4b3e-b558-6298d5388438", "x-misp-attribute--5b62fa2d-b974-44e2-a338-536ed5388438" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "osint:source-type=\"blog-post\"", "misp-galaxy:threat-actor=\"Cobalt\"", "misp-galaxy:mitre-enterprise-attack-relationship=\"Cobalt Strike uses PowerShell\"", "misp-galaxy:exploit-kit=\"ThreadKit\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Spearphishing Attachment - T1193\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"CMSTP - T1191\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Regsvr32 - T1117\"", "misp-galaxy:mitre-enterprise-attack-attack-pattern=\"PowerShell - T1086\"", "cert-ist:threat_targeted_system=\"Windows\"", "cert-ist:threat_targeted_sector=\"Finance\"", "cert-ist:enriched", "cert-ist:ioc_accuracy=\"high\"", "cert-ist:threat_level=\"low\"", "cert-ist:threat_type=\"apt\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5b61a4a4-4d74-4c18-8d63-dab70acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:22:34.000Z", "modified": "2018-08-02T12:22:34.000Z", "first_observed": "2018-08-02T12:22:34Z", "last_observed": "2018-08-02T12:22:34Z", "number_observed": 1, "object_refs": [ "url--5b61a4a4-4d74-4c18-8d63-dab70acd0835" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5b61a4a4-4d74-4c18-8d63-dab70acd0835", "value": "https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html" }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5b61a605-d6e8-46be-9308-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:22:29.000Z", "modified": "2018-08-01T12:22:29.000Z", "name": "CVE-2017-11882", "labels": [ "misp:type=\"vulnerability\"", "misp:category=\"External analysis\"" ], "external_references": [ { "source_name": "cve", "external_id": "CVE-2017-11882" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5b61a605-0744-4a88-9b28-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:22:29.000Z", "modified": "2018-08-01T12:22:29.000Z", "name": "CVE-2017-8570", "labels": [ "misp:type=\"vulnerability\"", "misp:category=\"External analysis\"" ], "external_references": [ { "source_name": "cve", "external_id": "CVE-2017-8570" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5b61a605-8784-4f8e-81b5-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:22:29.000Z", "modified": "2018-08-01T12:22:29.000Z", "name": "CVE-2017-0199", "labels": [ "misp:type=\"vulnerability\"", "misp:category=\"External analysis\"" ], "external_references": [ { "source_name": "cve", "external_id": "CVE-2017-0199" } ] }, { "type": "vulnerability", "spec_version": "2.1", "id": "vulnerability--5b61a605-c430-4b44-92a6-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:22:29.000Z", "modified": "2018-08-01T12:22:29.000Z", "name": "CVE-2018-8174", "labels": [ "misp:type=\"vulnerability\"", "misp:category=\"External analysis\"" ], "external_references": [ { "source_name": "cve", "external_id": "CVE-2018-8174" } ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-dbb8-4b87-b7e9-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'af9ed7de1d9d9d38ee12ea2d3c62ab01a79c6f4b241c02110bac8a53ea9798b5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-11d0-4c0b-887f-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'e4081eb7f47d76c57bbbe36456eaa4108f488ead5022630ad9b383e84129ffa9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-5344-4e03-ae4f-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'bebd4cd9aece49fbe6e7024e239638004358ff87d02f9bd4328993409da9e17c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-15a8-4917-9b25-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = '7762bfb2c3251aea23fb0553dabb13db730a7e3fc95856d8b7a276000b9be1f5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-2f4c-4f41-9651-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'a1f3388314c4abd7b1d3ad2aeb863c9c40a56bf438c7a2b71cbcff384d7e7ded']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-fef8-414a-9fd0-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'dc448907dd8d46bad0e996e7d23dd35ebe04873bc4bb7a8d26feaa47d09d1eab']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-e54c-4cc0-b622-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = 'cbbf2de2fbd4bce3f9a6c7c2a3efd97c729ec506c654ce89cd187d7051717289']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a657-dcd0-45ba-be79-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:23:51.000Z", "modified": "2018-08-01T12:23:51.000Z", "description": "Malicious RTF doc", "pattern": "[file:hashes.SHA256 = '40f97cf37c136209a65d5582963a72352509eb802da7f1f5b4478a0d9e0817e8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:23:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "RTF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a68c-1848-4dd4-8cf2-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:24:44.000Z", "modified": "2018-08-01T12:24:44.000Z", "description": "Malicious Word Doc(x)", "pattern": "[file:hashes.SHA256 = 'e566db9e491fda7a5d28ffe9019be64b4d9bc75014bbe189a9dcb9d987856558']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:24:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "Word Doc(x)" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a68c-6d50-4a2e-bdb9-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:24:44.000Z", "modified": "2018-08-01T12:24:44.000Z", "description": "Malicious Word Doc(x)", "pattern": "[file:hashes.SHA256 = '9ddc22718945ac8e29748999d64594c368e20efefc4917d36fead8a9a8151366']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:24:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "Word Doc(x)" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a68c-1b00-4519-95c7-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:24:44.000Z", "modified": "2018-08-01T12:24:44.000Z", "description": "Malicious Word Doc(x)", "pattern": "[file:hashes.SHA256 = '1247e1586a58b3be116d83c62397c9a16ccc8c943967e20d1d504b14a596157c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:24:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "Word Doc(x)" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6a4-9704-4934-a3de-ecbf0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:54.000Z", "modified": "2018-08-01T12:27:54.000Z", "description": "DROPPER DLLS", "pattern": "[file:hashes.SHA256 = 'cc2e9c6d8bce799829351bd25a64c9b332958038365195e054411b136be61a4f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "DROPPER DLLS" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6a4-f93c-4f07-87e5-ecbf0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:50.000Z", "modified": "2018-08-01T12:27:50.000Z", "description": "DROPPER DLLS", "pattern": "[file:hashes.SHA256 = '0fef1863af0d7da7ddcfd3727f8fa08d66cd2d9ab4d5300dd3c57e908144edb6']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:50Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "DROPPER DLLS" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6a4-383c-4296-9023-ecbf0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:12.000Z", "modified": "2018-08-01T12:27:12.000Z", "description": "DROPPER DLLS", "pattern": "[file:hashes.SHA256 = '74af98fb016bf3adb51f49dff0a88c27bf4437e625a0c7557215a618a7b469a1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "DROPPER DLLS" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6a4-beb8-4ddf-a1f3-ecbf0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:47.000Z", "modified": "2018-08-01T12:27:47.000Z", "description": "DROPPER DLLS", "pattern": "[file:hashes.SHA256 = '844f56b5005946ebc83133b885c89e74bc4985bc3606d3e7a342a6ca9fa1cc0e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "DROPPER DLLS" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6c0-b97c-42f6-a819-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:41.000Z", "modified": "2018-08-01T12:27:41.000Z", "description": "SCRIPTLET", "pattern": "[file:hashes.SHA256 = '283f733d308fe325a0703af9857f59212e436f35fb6063a1b69877613936fc08']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "SCRIPTLET" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6c0-17a0-4ea2-be60-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:38.000Z", "modified": "2018-08-01T12:27:38.000Z", "description": "SCRIPTLET", "pattern": "[file:hashes.SHA256 = 'afeabc34e3260f1a1c03988a3eac494cc403a88711c2391ea3381a500e424940']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "SCRIPTLET" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6c0-6384-4fee-a10d-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:35.000Z", "modified": "2018-08-01T12:27:35.000Z", "description": "SCRIPTLET", "pattern": "[file:hashes.SHA256 = '3b73ebb834282ae3ffcaeb3c3384fd4a721d78fff5e7f1d5fd63a9c244d84c48']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "SCRIPTLET" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6c0-4ad8-4e14-b6e1-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:32.000Z", "modified": "2018-08-01T12:27:32.000Z", "description": "SCRIPTLET", "pattern": "[file:hashes.SHA256 = '4afba1aa6b58dc3754fe2ff20c0c23ce6371ba89094827fe83bb994329fa16a3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:32Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"", "SCRIPTLET" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6de-37c4-4869-ac92-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:26:06.000Z", "modified": "2018-08-01T12:26:06.000Z", "description": "Malicious PDF", "pattern": "[file:hashes.SHA256 = '5ac1612535b6981259cfac95efe84c5608cf51e3a49b9c1e00c5d374f90d10b2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:26:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "PDF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6de-3770-4d3d-989b-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:26:06.000Z", "modified": "2018-08-01T12:26:06.000Z", "description": "Malicious PDF", "pattern": "[file:hashes.SHA256 = '9d6fd7239e1baac696c001cabedfeb72cf0c26991831819c3124a0a726e8fe23']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:26:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "PDF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6de-cf40-4492-a692-ea300acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:26:06.000Z", "modified": "2018-08-01T12:26:06.000Z", "description": "Malicious PDF", "pattern": "[file:hashes.SHA256 = 'df18e997a2f755159f0753c4e69a45764f746657b782f6d3c878afb8befe2b69']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:26:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "PDF" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a6f6-cc20-40f6-8ae5-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:27:15.000Z", "modified": "2018-08-01T12:27:15.000Z", "description": "Decoy Doc", "pattern": "[file:hashes.SHA256 = 'f1004c0d6bf312ed8696c364d94bf6e63a907c80348ebf257ceae8ed5340536b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:27:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"", "Decoy" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a713-8f40-49b0-9c95-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:26:59.000Z", "modified": "2018-08-01T12:26:59.000Z", "description": "EXECUTABLE PAYLOADS", "pattern": "[file:hashes.SHA256 = 'f266070d4fe999eae02319cb42808ec0e0306125beda92f68e0b59b9f5bcac5a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:26:59Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"", "Payload" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a713-12f0-4607-8076-ecc80acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:26:59.000Z", "modified": "2018-08-01T12:26:59.000Z", "description": "EXECUTABLE PAYLOADS", "pattern": "[file:hashes.SHA256 = 'fc004992ad317eb97d977bd7139dbcc4f11c4447a26703d931df33e72fd96db3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:26:59Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"", "Payload" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a796-5f54-42e5-9d58-ed810acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:10.000Z", "modified": "2018-08-01T12:29:10.000Z", "description": "URLs to pull docs", "pattern": "[url:value = 'http://95.142.39.109/e1.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Download" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a796-a1d0-4c35-80ac-ed810acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:10.000Z", "modified": "2018-08-01T12:29:10.000Z", "description": "URLs to pull docs", "pattern": "[url:value = 'https://kaspersky-security.com/Complaint.doc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Download" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a796-7ed4-4d7b-9602-ed810acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:10.000Z", "modified": "2018-08-01T12:29:10.000Z", "description": "URLs to pull docs", "pattern": "[url:value = 'https://mcafeecloud.us/complaints/67972318.doc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Download" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a796-103c-4dfb-b730-ed810acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:10.000Z", "modified": "2018-08-01T12:29:10.000Z", "description": "URLs to pull docs", "pattern": "[url:value = 'https://s3.sovereigncars.org.uk/inv005189.pdf']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Download" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-df00-4cf5-b611-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://nl.web-cdn.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-ced4-48f5-9ac1-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://mail.halcyonih.com/m.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-7bfc-4d40-9980-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://mail.halcyonih.com/humans.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-f6dc-4776-8aa3-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://secure.n-document.biz/humans.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-ebbc-4066-95ff-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://xstorage.biz/robots.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-d0d4-4ff2-b054-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://cloud.yourdocument.biz/robots.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-cc5c-4d59-8114-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://cloud-direct.biz/robots.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-505c-4457-9367-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:23:26.000Z", "modified": "2018-08-02T12:23:26.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[file:name = 'http://documents.total-cloud.biz/version.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-02T12:23:26Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-f0e0-41a6-b338-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://cloud.pallets32.com/robots.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7c6-bb0c-416f-a065-dd5f0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:29:58.000Z", "modified": "2018-08-01T12:29:58.000Z", "description": "STAGE 1 - DROP DLL DROPPER", "pattern": "[url:value = 'http://document.cdn-one.biz/robots.txt']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:29:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Stage 1", " Download", " DLL Dropper" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7ec-1368-4a13-ab39-d5860acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:30:36.000Z", "modified": "2018-08-01T12:30:36.000Z", "description": "BACKDOOR C2", "pattern": "[url:value = 'https://api.outlook.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:30:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Backdoor", " C2" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7ec-9aac-4800-8196-d5860acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:30:36.000Z", "modified": "2018-08-01T12:30:36.000Z", "description": "BACKDOOR C2", "pattern": "[url:value = 'http://api.fujitsu.org.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:30:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Backdoor", " C2" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7ec-0eec-4a3e-b7eb-d5860acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:30:36.000Z", "modified": "2018-08-01T12:30:36.000Z", "description": "BACKDOOR C2", "pattern": "[url:value = 'http://api.asus.org.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:30:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Backdoor", " C2" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7ec-576c-43e6-a597-d5860acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:30:36.000Z", "modified": "2018-08-01T12:30:36.000Z", "description": "BACKDOOR C2", "pattern": "[url:value = 'http://api.toshiba.org.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:30:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Backdoor", " C2" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a7ec-eb10-4845-94b0-d5860acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:30:36.000Z", "modified": "2018-08-01T12:30:36.000Z", "description": "BACKDOOR C2", "pattern": "[url:value = 'http://api.miria.kz']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:30:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Backdoor", " C2" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a808-c654-420e-aac4-ea2c0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:31:04.000Z", "modified": "2018-08-01T12:31:04.000Z", "description": "POWERSHELL STAGE", "pattern": "[url:value = 'http://95.142.39.109/driver']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:31:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Powershell" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a808-74d8-4b61-86f5-ea2c0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:31:04.000Z", "modified": "2018-08-01T12:31:04.000Z", "description": "POWERSHELL STAGE", "pattern": "[url:value = 'http://95.142.39.109/wdriver']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:31:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Powershell" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a825-f9fc-4a4e-be81-f0ac0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:31:33.000Z", "modified": "2018-08-01T12:31:33.000Z", "description": "Decoy Doc", "pattern": "[url:value = 'http://95.142.39.109/document.doc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:31:33Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Download", " Decoy", " Doc(x)" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5b61a852-73a0-41e3-9a50-f0ac0acd0835", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-01T12:32:18.000Z", "modified": "2018-08-01T12:32:18.000Z", "description": "COBALT STRIKE BEACON STAGE", "pattern": "[url:value = 'https://95.142.39.109/vFGY']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-08-01T12:32:18Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"", "Cobalt Strike", " Cobalt Strike Beacon" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2c-1be8-453f-be37-536fd5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Attack name", "x_misp_type": "text", "x_misp_value": "COBALT" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5b62fa2c-0698-4e7d-9380-76b1d5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "first_observed": "2018-08-02T12:33:48Z", "last_observed": "2018-08-02T12:33:48Z", "number_observed": 1, "object_refs": [ "url--5b62fa2c-0698-4e7d-9380-76b1d5388438" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5b62fa2c-0698-4e7d-9380-76b1d5388438", "value": "https://wws.cert-ist.com/private/fr/IocAttack_details?format=html&objectType=ATK&ref=CERT-IST/ATK-2016-069" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2c-a150-4a9f-8180-711dd5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Attack Alias", "x_misp_type": "comment", "x_misp_value": "Buhtrap" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2c-6c08-4672-8755-711cd5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Attack Alias", "x_misp_type": "comment", "x_misp_value": "Cobalt Gang" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2c-764c-49f1-9d4c-5371d5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Attack Alias", "x_misp_type": "comment", "x_misp_value": "Cobalt Group" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2c-5288-4f56-bff2-5370d5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:48.000Z", "modified": "2018-08-02T12:33:48.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Description", "x_misp_type": "comment", "x_misp_value": "These IOCs originate in a blog post by Cisco Talos regarding several malicious email campaigns attributed to the Cobalt Gang group between May and July 2018. The infection vector consist in .pdf, .rtf, or .doc attachments. Some of the .rtf or .doc files exploit known Microsoft Office vulnerabilities.\r\n\r\nThe kill chain is rather complex, involving vulnerability exploitation, JScript, PowerShell and DLL loading via legitimate Windows tools." }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2d-9724-4c15-bdcb-7a59d5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:49.000Z", "modified": "2018-08-02T12:33:49.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Malware Name", "x_misp_type": "comment", "x_misp_value": "More_eggs" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2d-7b98-4f78-9fa3-7b2cd5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:49.000Z", "modified": "2018-08-02T12:33:49.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_comment": "Cert-IST Malware Name", "x_misp_type": "comment", "x_misp_value": "Cobalt Strike" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2d-8128-4b3e-b558-6298d5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:49.000Z", "modified": "2018-08-02T12:33:49.000Z", "labels": [ "misp:type=\"datetime\"", "misp:category=\"Other\"" ], "x_misp_category": "Other", "x_misp_comment": "Cert-IST First Seen Date", "x_misp_type": "datetime", "x_misp_value": "2018-05-14T22:00:00+00:00" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5b62fa2d-b974-44e2-a338-536ed5388438", "created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a", "created": "2018-08-02T12:33:49.000Z", "modified": "2018-08-02T12:33:49.000Z", "labels": [ "misp:type=\"datetime\"", "misp:category=\"Other\"" ], "x_misp_category": "Other", "x_misp_comment": "Cert-IST First Disclosed Date", "x_misp_type": "datetime", "x_misp_value": "2018-07-30T22:00:00+00:00" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }