{ "type": "bundle", "id": "bundle--5bf26a1e-c40c-4977-92bf-49b5950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T20:45:10.000Z", "modified": "2018-11-23T20:45:10.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--5bf26a1e-c40c-4977-92bf-49b5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T20:45:10.000Z", "modified": "2018-11-23T20:45:10.000Z", "name": "OSINT - Analyzing OilRig\u00e2\u20ac\u2122s Ops Tempo from Testing to Weaponization to Delivery", "published": "2018-11-23T20:45:44Z", "object_refs": [ "observed-data--5bf26a3e-d790-4108-a5c2-42f3950d210f", "url--5bf26a3e-d790-4108-a5c2-42f3950d210f", "x-misp-object--5bf26ab1-ed4c-469a-ac83-47bb950d210f", "indicator--5bf3dce0-e154-434e-be43-4821950d210f", "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f", "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f", "indicator--5bf3e027-58cc-471c-8631-48ca950d210f", "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f", "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f", "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f", "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f", "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f", "indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f", "indicator--5bf3e138-ff28-42ec-9f56-47c9950d210f", "indicator--047611a6-5a28-4b87-b780-294ba4294090", "x-misp-object--fda3b99c-dfe0-4a2d-a25c-a090747840f0", "indicator--6b9cd6df-e2bc-4e1a-80e9-ee7ffae3118d", "x-misp-object--bb78ca9b-0143-46ea-8e86-a073d1c775ef", "indicator--269a6029-b0d9-4b40-9e49-a7a3aed9c0d3", "x-misp-object--f59ce05a-f1d2-4950-b869-2e92c7fe2868", "indicator--42cf5c4b-cf6d-42e3-9087-8c80a04601ca", "x-misp-object--a46e4d62-977b-413d-badc-fb6e5c5a0e1c", "indicator--e2383a48-9b23-45e2-a84a-ed24c1d37dc9", "x-misp-object--51ae8cb9-75a4-4d15-b187-5b090a4c74fd", "indicator--4f0b9cf7-862d-4c57-8cca-df5f5a10f03c", "x-misp-object--e9b7d750-27c6-4541-a321-fbb1a09f109c", "indicator--afa6a24c-5dd6-4442-9ceb-16e2f01a191c", "x-misp-object--56446261-9fab-49e6-a549-e29edc190172", "indicator--e128e6b0-ac23-4f86-88e1-2bcae21d534f", "x-misp-object--c762bc16-95be-413d-9e4f-9acc1062e2ca", "indicator--618f6529-fd0f-43f8-94b6-2280c18a4fa7", "x-misp-object--e5e043ab-3878-4da7-8bdf-f4d0d40bbe24", "indicator--bc15eef6-7731-4ad4-9120-aba92a793716", "x-misp-object--ba69395d-29ab-424a-9e69-32e79919b172", "indicator--f70d1c99-bb3e-4af6-a1c0-e49a234caaa5", "x-misp-object--1f7d2e55-565e-46d2-b577-071d917de53d", "relationship--71aeb2e7-d490-4a22-b2ec-f8aa8bc3040e", "relationship--d6ae5bc8-e6ff-413d-81ab-dd7b37d230db", "relationship--ff26a279-11ee-4f2c-b37b-3944f2ac20e6", "relationship--f08bf61a-74cd-4048-b483-0de319f2b292", "relationship--ae0fbd8f-bcf0-45c6-8ab4-ef9d63d5ecba", "relationship--51f81949-a060-4860-aa77-8f64bdd21397", "relationship--0ef9948b-e241-4b71-8725-c38131b39875", "relationship--6af2fc6d-70c2-41bd-bfcc-26391e9f8431", "relationship--945471b0-6676-4d84-8bd5-650d4dcd7088" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:malpedia=\"BONDUPDATER\"", "misp-galaxy:mitre-enterprise-attack-intrusion-set=\"OilRig\"", "misp-galaxy:mitre-intrusion-set=\"OilRig\"", "misp-galaxy:threat-actor=\"OilRig\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5bf26a3e-d790-4108-a5c2-42f3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-19T07:46:27.000Z", "modified": "2018-11-19T07:46:27.000Z", "first_observed": "2018-11-19T07:46:27Z", "last_observed": "2018-11-19T07:46:27Z", "number_observed": 1, "object_refs": [ "url--5bf26a3e-d790-4108-a5c2-42f3950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"", "osint:source-type=\"blog-post\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5bf26a3e-d790-4108-a5c2-42f3950d210f", "value": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5bf26ab1-ed4c-469a-ac83-47bb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T20:44:35.000Z", "modified": "2018-11-23T20:44:35.000Z", "labels": [ "misp:name=\"microblog\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "text", "object_relation": "post", "value": "Unit 42\u00e2\u20ac\u2122s continued look into #OilRig analyzes the group\u00e2\u20ac\u2122s operational tempo, including testing, weaponization and attack delivery. Get the full report (link: https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/) researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/", "category": "Other", "uuid": "5bf26ab1-f394-4f15-ac6d-4c87950d210f" }, { "type": "text", "object_relation": "type", "value": "Twitter", "category": "Other", "uuid": "5bf26ab2-a9e4-417f-b9f4-4f53950d210f" }, { "type": "link", "object_relation": "url", "value": "https://mobile.twitter.com/Unit42_Intel/status/1063461728971907072", "category": "External analysis", "uuid": "5bf26ab2-ed98-4f18-a4a0-4627950d210f" }, { "type": "datetime", "object_relation": "creation-date", "value": "2018-11-16T05:00:00", "category": "Other", "uuid": "5bf26ab3-a42c-4278-aad5-44db950d210f" }, { "type": "text", "object_relation": "username", "value": "@Unit42_Intel", "category": "Other", "uuid": "5bf26ab3-b264-44e7-b47a-47a2950d210f" } ], "x_misp_meta_category": "misc", "x_misp_name": "microblog" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3dce0-e154-434e-be43-4821950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T10:07:45.000Z", "modified": "2018-11-20T10:07:45.000Z", "pattern": "[file:hashes.SHA256 = '6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T10:07:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:33:41.000Z", "modified": "2018-11-20T13:33:41.000Z", "pattern": "[file:hashes.SHA256 = '9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:33:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:33:27.000Z", "modified": "2018-11-20T13:33:27.000Z", "pattern": "[file:hashes.SHA256 = 'a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:33:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:33:15.000Z", "modified": "2018-11-20T13:33:15.000Z", "pattern": "[file:hashes.SHA256 = '6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3' AND file:name = 'XLS-withyourface \u00e2\u20ac\u201c test.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:33:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:32:45.000Z", "modified": "2018-11-20T13:32:45.000Z", "pattern": "[file:hashes.SHA256 = '056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:32:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:32:26.000Z", "modified": "2018-11-20T13:32:26.000Z", "pattern": "[file:hashes.SHA256 = '216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:32:26Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:32:06.000Z", "modified": "2018-11-20T13:32:06.000Z", "pattern": "[file:hashes.SHA256 = '687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:32:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:31:49.000Z", "modified": "2018-11-20T13:31:49.000Z", "pattern": "[file:hashes.SHA256 = '364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:31:49Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:31:20.000Z", "modified": "2018-11-20T13:31:20.000Z", "pattern": "[file:hashes.SHA256 = '66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633' AND file:name = 'sss \u00e2\u20ac\u201c Copy.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:31:20Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T13:30:58.000Z", "modified": "2018-11-20T13:30:58.000Z", "pattern": "[file:hashes.SHA256 = '70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702' AND file:name = 'sss \u00e2\u20ac\u201c Copy.xls' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T13:30:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5bf3e138-ff28-42ec-9f56-47c9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-20T10:26:00.000Z", "modified": "2018-11-20T10:26:00.000Z", "pattern": "[file:hashes.SHA256 = '7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00' AND file:name = 'N56.15.doc' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-20T10:26:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--047611a6-5a28-4b87-b780-294ba4294090", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:14:52.000Z", "modified": "2018-11-23T09:14:52.000Z", "pattern": "[file:hashes.MD5 = '7d08fd0f5abe8c928d223c592e961274' AND file:hashes.SHA1 = '4b84d94d957695b9bb097dd32d17858412f6c68e' AND file:hashes.SHA256 = '66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:14:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--fda3b99c-dfe0-4a2d-a25c-a090747840f0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:14:53.000Z", "modified": "2018-11-23T09:14:53.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:49", "category": "Other", "uuid": "a6713e81-cb73-4896-8a19-a64faa51c558" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633/analysis/1542707989/", "category": "External analysis", "uuid": "2bf87a9e-e60c-41d7-ab40-b4b91edbc40f" }, { "type": "text", "object_relation": "detection-ratio", "value": "37/59", "category": "Other", "uuid": "6cd2ece3-1b96-478f-808e-885dfafb0d85" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6b9cd6df-e2bc-4e1a-80e9-ee7ffae3118d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:14:54.000Z", "modified": "2018-11-23T09:14:54.000Z", "pattern": "[file:hashes.MD5 = 'ec94c2102c727f9e2707143d81bc5555' AND file:hashes.SHA1 = '4182f8ccc24d18643c55ad2bb140a69022ff6b8c' AND file:hashes.SHA256 = '6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:14:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--bb78ca9b-0143-46ea-8e86-a073d1c775ef", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:14:57.000Z", "modified": "2018-11-23T09:14:57.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:43", "category": "Other", "uuid": "f9d9ba58-0c08-4fa8-bd2f-84c8d10074f4" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f/analysis/1542707983/", "category": "External analysis", "uuid": "b1a901cd-3a99-485c-a074-7938e7ad9282" }, { "type": "text", "object_relation": "detection-ratio", "value": "39/58", "category": "Other", "uuid": "4f1ed999-43b2-4fe5-b91c-3beece0924f1" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--269a6029-b0d9-4b40-9e49-a7a3aed9c0d3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:14:58.000Z", "modified": "2018-11-23T09:14:58.000Z", "pattern": "[file:hashes.MD5 = 'fb854cc448f60ca750cd7bf3486db11b' AND file:hashes.SHA1 = '857a1819a3cc1fd650165fe1a0d7b6dab16171c8' AND file:hashes.SHA256 = '687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:14:58Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f59ce05a-f1d2-4950-b869-2e92c7fe2868", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:00.000Z", "modified": "2018-11-23T09:15:00.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:47", "category": "Other", "uuid": "d18566f2-e6c7-43f8-be02-94e538a1b200" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3/analysis/1542707987/", "category": "External analysis", "uuid": "8ef6f840-97e8-46fe-9566-7f94fc6d9536" }, { "type": "text", "object_relation": "detection-ratio", "value": "36/59", "category": "Other", "uuid": "60e3774e-fde8-49b6-88c0-b2b85aab1e0a" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--42cf5c4b-cf6d-42e3-9087-8c80a04601ca", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:02.000Z", "modified": "2018-11-23T09:15:02.000Z", "pattern": "[file:hashes.MD5 = 'aa7c9cc7063d4e541246034485fc114e' AND file:hashes.SHA1 = 'f390069d7e72300acbf5171a70a6c512ac9dfc92' AND file:hashes.SHA256 = '364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:02Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--a46e4d62-977b-413d-badc-fb6e5c5a0e1c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:04.000Z", "modified": "2018-11-23T09:15:04.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:48", "category": "Other", "uuid": "f4b018ee-9d3c-452f-bc71-9b84beac52cf" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56/analysis/1542707988/", "category": "External analysis", "uuid": "ae7753b3-514a-406f-a5d6-1c95a3eed682" }, { "type": "text", "object_relation": "detection-ratio", "value": "36/58", "category": "Other", "uuid": "123f8af4-c44b-41ed-8bc2-9ef2f6989a42" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e2383a48-9b23-45e2-a84a-ed24c1d37dc9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:06.000Z", "modified": "2018-11-23T09:15:06.000Z", "pattern": "[file:hashes.MD5 = 'd93927f31afa691bc0d1107ab28fc0f1' AND file:hashes.SHA1 = '4534a9e6c1b1c83929df0a107976432d1bef781e' AND file:hashes.SHA256 = '70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--51ae8cb9-75a4-4d15-b187-5b090a4c74fd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:09.000Z", "modified": "2018-11-23T09:15:09.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:50", "category": "Other", "uuid": "b02a459d-edb2-4a4b-bf00-5ed634e74a81" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702/analysis/1542707990/", "category": "External analysis", "uuid": "4c7c9ecd-7ded-4f6a-85d3-e9468d620cf3" }, { "type": "text", "object_relation": "detection-ratio", "value": "33/58", "category": "Other", "uuid": "9bd6849a-911f-4881-abd8-fa766d220bf9" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4f0b9cf7-862d-4c57-8cca-df5f5a10f03c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:12.000Z", "modified": "2018-11-23T09:15:12.000Z", "pattern": "[file:hashes.MD5 = '10e1387eb09286518db5cc22b763a3fd' AND file:hashes.SHA1 = 'd517425ff63b929755a023cd2ab04db4174511b2' AND file:hashes.SHA256 = '216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e9b7d750-27c6-4541-a321-fbb1a09f109c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:14.000Z", "modified": "2018-11-23T09:15:14.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:46", "category": "Other", "uuid": "466fa265-7cbc-4676-85af-49f0f6cdba76" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576/analysis/1542707986/", "category": "External analysis", "uuid": "2c32669a-46af-44b6-a0c4-4d060ab92fa6" }, { "type": "text", "object_relation": "detection-ratio", "value": "35/59", "category": "Other", "uuid": "6cb17ee7-fb52-4fd1-8b91-9475cb2694dd" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--afa6a24c-5dd6-4442-9ceb-16e2f01a191c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:16.000Z", "modified": "2018-11-23T09:15:16.000Z", "pattern": "[file:hashes.MD5 = '52b6e1ef0d079f4c2572705156365c06' AND file:hashes.SHA1 = '5732b44851ec10f16c8e1201af3bec455f724961' AND file:hashes.SHA256 = '7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--56446261-9fab-49e6-a549-e29edc190172", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:18.000Z", "modified": "2018-11-23T09:15:18.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:50", "category": "Other", "uuid": "02482eed-8c8d-442b-a20b-ffda43ede01f" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00/analysis/1542707990/", "category": "External analysis", "uuid": "340cf732-cbec-4574-a76d-601543efd766" }, { "type": "text", "object_relation": "detection-ratio", "value": "39/58", "category": "Other", "uuid": "feb1c47b-754f-4d6f-ba9d-1960e7fa9203" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e128e6b0-ac23-4f86-88e1-2bcae21d534f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:19.000Z", "modified": "2018-11-23T09:15:19.000Z", "pattern": "[file:hashes.MD5 = '11bf5c50f45b9c8aca1d86ae2e2aec44' AND file:hashes.SHA1 = 'c04c44d0b44f79a6d46799e0db999add0457d24b' AND file:hashes.SHA256 = 'a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c762bc16-95be-413d-9e4f-9acc1062e2ca", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:20.000Z", "modified": "2018-11-23T09:15:20.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:44", "category": "Other", "uuid": "d61dc799-8a36-44e4-a8ec-7614ab44609c" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e/analysis/1542707984/", "category": "External analysis", "uuid": "ea090e3d-20b3-40ac-bf60-ed36cdbde852" }, { "type": "text", "object_relation": "detection-ratio", "value": "29/58", "category": "Other", "uuid": "d8ad0eaa-ac87-4cdc-9f2c-989f3a82db71" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--618f6529-fd0f-43f8-94b6-2280c18a4fa7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:21.000Z", "modified": "2018-11-23T09:15:21.000Z", "pattern": "[file:hashes.MD5 = 'ac685796da5c02bec61c2909867892ad' AND file:hashes.SHA1 = '8aff94d7eaf14d1b28f15cbe239cbc6b7882172c' AND file:hashes.SHA256 = '6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e5e043ab-3878-4da7-8bdf-f4d0d40bbe24", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:23.000Z", "modified": "2018-11-23T09:15:23.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-22T12:29:55", "category": "Other", "uuid": "05a067d9-e5b3-4042-909a-5319a369675e" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3/analysis/1542889795/", "category": "External analysis", "uuid": "21fe45d8-52fc-47b9-8a99-647d89f6e835" }, { "type": "text", "object_relation": "detection-ratio", "value": "37/59", "category": "Other", "uuid": "d196ac6e-909d-4cec-86b3-57aa476147d6" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bc15eef6-7731-4ad4-9120-aba92a793716", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:24.000Z", "modified": "2018-11-23T09:15:24.000Z", "pattern": "[file:hashes.MD5 = 'c99df7fbff1bf73f818e6ab9d008a37c' AND file:hashes.SHA1 = '0eea9b6501bcd788d63f783690e6fc8e7f842377' AND file:hashes.SHA256 = '9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:24Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--ba69395d-29ab-424a-9e69-32e79919b172", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:25.000Z", "modified": "2018-11-23T09:15:25.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:44", "category": "Other", "uuid": "0041407e-fa19-4e11-bea9-377951552df3" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce/analysis/1542707984/", "category": "External analysis", "uuid": "e81e8285-d90c-4e15-9454-cd514b261c1e" }, { "type": "text", "object_relation": "detection-ratio", "value": "37/58", "category": "Other", "uuid": "fa4f0d34-61ee-4697-aaea-3f67ae251764" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f70d1c99-bb3e-4af6-a1c0-e49a234caaa5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:27.000Z", "modified": "2018-11-23T09:15:27.000Z", "pattern": "[file:hashes.MD5 = '8fec2d11642f8d6c5fc25839c6739fc3' AND file:hashes.SHA1 = 'd2ce79b276e4ae0538e2ba168284425eaa709046' AND file:hashes.SHA256 = '056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2018-11-23T09:15:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--1f7d2e55-565e-46d2-b577-071d917de53d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2018-11-23T09:15:28.000Z", "modified": "2018-11-23T09:15:28.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-11-20T09:59:46", "category": "Other", "uuid": "371753f9-4742-452e-83ff-9300b1d34c79" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa/analysis/1542707986/", "category": "External analysis", "uuid": "71c1cb17-164a-43be-afcf-5ad78c11b409" }, { "type": "text", "object_relation": "detection-ratio", "value": "37/58", "category": "Other", "uuid": "701771f6-7ca6-4ab0-a213-d030b083d7ad" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--71aeb2e7-d490-4a22-b2ec-f8aa8bc3040e", "created": "2018-11-20T13:33:41.000Z", "modified": "2018-11-20T13:33:41.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f", "target_ref": "indicator--5bf3dce0-e154-434e-be43-4821950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6ae5bc8-e6ff-413d-81ab-dd7b37d230db", "created": "2018-11-20T13:33:27.000Z", "modified": "2018-11-20T13:33:27.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f", "target_ref": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ff26a279-11ee-4f2c-b37b-3944f2ac20e6", "created": "2018-11-20T13:33:15.000Z", "modified": "2018-11-20T13:33:15.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f", "target_ref": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f08bf61a-74cd-4048-b483-0de319f2b292", "created": "2018-11-20T13:32:45.000Z", "modified": "2018-11-20T13:32:45.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f", "target_ref": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--ae0fbd8f-bcf0-45c6-8ab4-ef9d63d5ecba", "created": "2018-11-20T13:32:26.000Z", "modified": "2018-11-20T13:32:26.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f", "target_ref": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--51f81949-a060-4860-aa77-8f64bdd21397", "created": "2018-11-20T13:32:06.000Z", "modified": "2018-11-20T13:32:06.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f", "target_ref": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0ef9948b-e241-4b71-8725-c38131b39875", "created": "2018-11-20T13:31:49.000Z", "modified": "2018-11-20T13:31:49.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f", "target_ref": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--6af2fc6d-70c2-41bd-bfcc-26391e9f8431", "created": "2018-11-20T13:31:20.000Z", "modified": "2018-11-20T13:31:20.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f", "target_ref": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--945471b0-6676-4d84-8bd5-650d4dcd7088", "created": "2018-11-20T13:30:58.000Z", "modified": "2018-11-20T13:30:58.000Z", "relationship_type": "derived-from", "source_ref": "indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f", "target_ref": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }