{ "type": "bundle", "id": "bundle--5c9b92ae-0428-46ef-9ced-4d47950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-05T06:33:52.000Z", "modified": "2019-04-05T06:33:52.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "grouping", "spec_version": "2.1", "id": "grouping--5c9b92ae-0428-46ef-9ced-4d47950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-05T06:33:52.000Z", "modified": "2019-04-05T06:33:52.000Z", "name": "Bulletin d\u2019actualit\u00e9 CERTFR-2019-ACT-005", "context": "suspicious-activity", "object_refs": [ "observed-data--5c9c7c27-f578-43fb-8950-f682950d210f", "url--5c9c7c27-f578-43fb-8950-f682950d210f", "observed-data--5c9c80a8-de8c-4737-92ae-4250950d210f", "url--5c9c80a8-de8c-4737-92ae-4250950d210f", "indicator--5c9c9c28-b844-44bf-91d9-45c5950d210f", "indicator--5c9c9c28-2aa0-4318-b516-44f8950d210f", "x-misp-attribute--5c9ca433-92e0-4c95-a054-4528950d210f", "indicator--5c9cdbca-78dc-499a-86a2-4d6e950d210f", "indicator--5c9cdbca-0e04-42d7-ab25-4e14950d210f", "indicator--5c9cdcc4-d2dc-4f8c-8947-43c0950d210f", "indicator--5c9cdcc7-8654-45c7-b3b1-440b950d210f", "indicator--5c9cdccf-0b50-4881-8bfe-4b34950d210f", "indicator--5c9cdcd0-3b78-4d12-b3c2-42ea950d210f", "indicator--5c9cdcd0-2d68-4958-8ea1-4cc3950d210f", "indicator--5c9cdcd0-4e7c-4567-a324-4a7d950d210f", "x-misp-attribute--5c9e39dc-a38c-422e-903f-4831950d210f", "indicator--5ca1b269-0aa4-479e-80c5-457a950d210f", "indicator--5ca1b269-97c8-4a64-aec2-46f0950d210f", "indicator--5ca1b269-b02c-43ad-afbd-4f69950d210f", "indicator--5ca1b269-01f8-4c66-b7a6-4318950d210f", "indicator--5ca1b269-6478-47f0-a5cd-4e8f950d210f", "indicator--5ca1b269-9670-48a3-8bbe-4639950d210f", "indicator--5ca1b269-f7fc-4efd-9e26-4955950d210f", "indicator--5ca1b269-eb04-4df7-8a0b-41d9950d210f", "indicator--5ca1ce9d-cd4c-46b6-9a6a-3ff6950d210f", "indicator--5ca1ce9d-b568-4caf-bdff-3ff6950d210f", "indicator--5ca1d8cb-4e80-4388-9890-d6af950d210f", "indicator--5ca1d8cb-e228-4161-9aa7-d6af950d210f", "indicator--5ca1d8cb-f2a0-4fca-a92a-d6af950d210f", "indicator--5ca1d8cb-69b8-4968-9f67-d6af950d210f", "indicator--5ca1d8cb-1654-4bf2-b765-d6af950d210f", "indicator--5ca1d8cb-3414-41ec-9f72-d6af950d210f", "indicator--5ca1d8cb-8b64-4abe-87e7-d6af950d210f", "indicator--5ca1d8cb-121c-4714-aa3e-d6af950d210f", "indicator--5ca1d8cb-a8d8-46e0-aa54-d6af950d210f", "indicator--5ca1d8cb-6ed8-400b-b4fa-d6af950d210f", "indicator--5ca1d8cb-d90c-47f7-94c8-d6af950d210f", "indicator--5ca1d8cb-27c4-4c61-a7ef-d6af950d210f", "indicator--5ca1d8cc-5548-451c-9747-d6af950d210f", "indicator--5ca1d8cc-c67c-4701-8470-d6af950d210f", "indicator--5ca1d8cc-a450-4ef1-a1bb-d6af950d210f", "indicator--5ca1d8cc-f1c0-4dfc-85f9-d6af950d210f", "indicator--5ca1d8cc-5104-424c-bb78-d6af950d210f", "indicator--5ca1d8cc-2b0c-4ab6-9304-d6af950d210f", "indicator--5ca1d8cc-dc90-45a2-a6bf-d6af950d210f", "indicator--5ca1d8cc-fb50-48bc-8dbb-d6af950d210f", "indicator--5ca1d8cc-c190-4f11-9122-d6af950d210f", "indicator--5ca1d8cc-c2f0-469e-8883-d6af950d210f", "indicator--5ca1d8cc-0cd4-4431-a10f-d6af950d210f", "indicator--5ca1d8cc-6270-48ed-af05-d6af950d210f", "indicator--5ca1d8cc-dedc-4b55-ab68-d6af950d210f", "indicator--5ca1d8cc-3284-4bbd-a95a-d6af950d210f", "indicator--5ca1d8cc-589c-4067-adcd-d6af950d210f", "indicator--5ca1d8cc-ac04-4efc-a767-d6af950d210f", "indicator--5ca1d8cc-4df0-408a-8b83-d6af950d210f", "indicator--5ca1d8cc-f428-494a-86ac-d6af950d210f", "indicator--5ca1d8cc-2d24-4de1-8232-d6af950d210f", "indicator--5ca1d8cc-c530-4ce4-9202-d6af950d210f", "indicator--5ca1d8cc-5c10-4070-aebe-d6af950d210f", "indicator--5ca1d8cc-55a0-4f8a-baf7-d6af950d210f", "indicator--5ca1d8cc-84f4-476c-8619-d6af950d210f", "indicator--5ca1d8cc-4490-4918-ac84-d6af950d210f", "indicator--5ca1e082-87c0-4e54-891a-4dba950d210f", "indicator--5ca1e082-c73c-48e1-91c2-4875950d210f", "indicator--5ca1e082-a4c8-4094-be2e-4276950d210f", "indicator--5ca1e082-df5c-42e5-95c1-43ca950d210f", "indicator--5ca1e082-2f08-4f8b-a82a-4d65950d210f", "indicator--5ca1e082-08fc-4585-83d4-47c7950d210f", "indicator--5ca1e082-1960-4f42-89e3-4a5c950d210f", "indicator--5ca1e082-5a98-4ee3-afa7-48c0950d210f", "indicator--5ca1e082-9dc4-4403-aaaa-406e950d210f", "indicator--5ca1e082-1610-4df6-9bd7-4a89950d210f", "indicator--5ca1e082-0ebc-43d4-b476-48ea950d210f", "indicator--5ca1e082-aa0c-48ab-ac8e-4840950d210f", "indicator--5ca1e082-fed8-4893-b9c4-4dc7950d210f", "indicator--5ca1e082-e1c8-4d0d-8458-41eb950d210f", "indicator--5ca1e082-72d0-49db-8909-4523950d210f", "indicator--5ca1e082-7dfc-43c5-864b-494c950d210f", "indicator--5ca1e082-4b0c-4376-89e9-4075950d210f", "indicator--5ca1e082-c614-431c-b553-4eff950d210f", "indicator--5ca1e719-4834-41f6-be6d-4586950d210f", "indicator--5ca1e719-db18-46a6-9d1c-4acc950d210f", "indicator--5ca1e719-819c-451a-9977-400e950d210f", "indicator--5ca1e719-ffe4-4586-9f65-4c75950d210f", "indicator--5ca1e719-0af8-451f-9ab5-4828950d210f", "indicator--5ca1e71a-e47c-45fa-95f8-4ebc950d210f", "indicator--5ca1e71a-eb68-4e2f-afb1-405c950d210f", "indicator--5ca1e71a-4378-412c-acbe-499f950d210f", "indicator--5ca21226-bc58-47e2-bc18-4c09950d210f", "indicator--5ca21226-ff2c-4002-91db-40b4950d210f", "indicator--5ca21226-c4bc-43b0-b0da-40a8950d210f", "indicator--5ca61559-4fd4-4df0-976e-43ba950d210f", "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f", "indicator--5c9c882a-a40c-46db-a3f5-f383950d210f", "indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f", "indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f", "indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f", "indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f", "indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f", "indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f", "indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f", "indicator--5c9cdeef-4adc-461d-9b72-4062950d210f", "indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f", "indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f", "indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f", "indicator--5c9e3b43-3128-4838-8d63-4a69950d210f", "indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f", "indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f", "indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f", "indicator--5ca5e3be-9cc4-4a68-939e-bac6950d210f", "indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a", "x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7", "indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1", "x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989", "indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18", "x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8", "indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033", "x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9", "indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216", "x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab", "x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2", "x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370", "x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb", "x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1", "x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d", "x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9", "x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e", "x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87", "x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3", "x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044", "x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0", "x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d", "x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7", "x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0", "x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de", "indicator--b6346b5e-5482-4314-9d7b-8671c4155bf1", "indicator--d74356f9-39d2-4c30-9711-8ed1a401acd3", "indicator--e668ce8c-af43-4832-89b2-9c08e3f5124c", "indicator--6e1a65fa-acb6-4ea6-a06b-636c428138b5", "indicator--f7e26e48-37f4-45a8-8a1c-2ecc11dec53a", "indicator--d4db8abd-f691-4927-9e28-14ce0ee7d430", "indicator--3d49a49b-5bc6-49be-a0e6-ab3b72ccfe46", "indicator--f898f5e1-93e1-458b-996c-ebc6dba13222", "indicator--89b53bf3-e0c4-4f48-8e25-ff54844fae43", "indicator--1162a78a-804d-4856-82b3-0b77509bcfe7", "indicator--bf5439e4-3e35-44a0-9ff3-129042947aad", "indicator--02af3be3-4a7e-4a84-81eb-83f604a3f0a5", "indicator--dae97fa0-3eb3-4915-82cc-e7e489d64dd1", "indicator--24e6319c-f91c-43b2-a9d3-7b0bfd5a76a7", "indicator--3dac003b-a958-48e2-8a96-6d0fdba7875d", "indicator--c01e648d-7f49-45f7-b7d7-48ce5a507a47", "indicator--ac91f1d9-024c-44e2-8a7c-06172796ea12", "indicator--2ba4112d-7327-4b19-8035-a2e6eb73d573", "indicator--7f430f07-3ff9-4553-b81a-36681949c447", "indicator--6fe2ec22-3ff6-4a79-af8e-30e6a5253e45", "indicator--b14e7307-30f6-49c8-b4fe-0b6735a3a94d", "indicator--3549d1ed-c1c7-4066-a9cc-9d0a86cd8e0a", "indicator--eaa8dc3c-16ef-45eb-add4-3d736d1bd330", "indicator--7e91cd8c-c822-43fe-ac0b-5d137f57bc3a", "indicator--7b59d923-d374-41bc-89b7-e68498bacc72", "indicator--4b9fdc52-1ce3-45d7-85cc-60215eb30f0c", "indicator--fa63b93f-2201-4f6c-8341-4a86980805b3", "indicator--c73504a4-60da-4107-adef-c10a0f52266b", "indicator--edbac896-cf24-4628-9064-7bac3c8e8d58", "indicator--d91eacd1-efda-4eaf-ae5a-f815869b10dd", "indicator--a1a25873-3445-4873-8b6b-7dca2e15615a", "indicator--9aa33ad7-9f08-4774-b109-cedaed81cd60", "indicator--dc691061-1ee8-46b1-b3ef-488f082e45c8", "indicator--8d31887c-d4a7-4e7f-899c-df1d3a41e15f", "indicator--febd2cf8-35c9-49d2-9963-21b43acb6f04", "indicator--f63b62d9-f5f1-4c51-9488-139d016e7660", "relationship--befab1a1-2b4a-4540-952a-922278cf82c0", "relationship--d6c71559-29b0-48dd-9236-20c9f79ac1e1", "relationship--9aad7daf-6c59-4867-ba46-3232293ee3a8", "relationship--724f2840-888d-4639-85c8-a1eca39cc5ca", "relationship--0a6c6598-6f22-4d03-af41-5e2cdf61caae", "relationship--9af6cf96-af83-44ac-81a6-f8fbbcd8ce22", "relationship--a0a026c0-bd52-480a-9e06-184b87fccd01", "relationship--b82b8365-592c-429b-b8be-8b675cf76c24", "relationship--c8739605-5978-45e9-bdee-187564723288", "relationship--20d02435-b817-4bf1-9c03-bddbd24b0212", "relationship--419f5108-66d9-4623-b8a6-0d56789b4d9f", "relationship--96177536-f8e7-4ffb-8771-69feda28cc02", "relationship--f9305cde-1e4d-45bd-a0ca-cc4176c807fb", "relationship--9afb5fff-3b1d-42e8-9c36-9c612422b106", "relationship--cd469e0b-49ca-4af6-8603-4f2297e9cc79", "relationship--9304643c-6881-41e3-9198-04c65d84152b", "relationship--1a430efa-100e-405b-8264-4b85ee5665dc", "relationship--4b98aec3-9c78-4ac5-aee1-24e43314c48f", "relationship--d5fa14a8-ad21-4a78-8857-f209ef41a16a", "relationship--215abfc9-1d9c-482b-9b7e-0439fb0c579f", "relationship--948a3baa-9eed-495e-8bb6-aa62dd820348" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "misp-galaxy:malpedia=\"Ryuk\"", "misp-galaxy:ransomware=\"LockerGoga\"", "misp-galaxy:ransomware=\"Ryuk ransomware\"", "type:OSINT", "osint:lifetime=\"perpetual\"", "osint:certainty=\"50\"", "misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"", "misp-galaxy:mitre-tool=\"Cobalt Strike\"", "misp-galaxy:rat=\"Cobalt Strike\"" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5c9c7c27-f578-43fb-8950-f682950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-05T06:33:52.000Z", "modified": "2019-04-05T06:33:52.000Z", "first_observed": "2019-04-05T06:33:52Z", "last_observed": "2019-04-05T06:33:52Z", "number_observed": 1, "object_refs": [ "url--5c9c7c27-f578-43fb-8950-f682950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"", "osint:source-type=\"blog-post\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5c9c7c27-f578-43fb-8950-f682950d210f", "value": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2019-ACT-005/" }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--5c9c80a8-de8c-4737-92ae-4250950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T08:07:20.000Z", "modified": "2019-03-28T08:07:20.000Z", "first_observed": "2019-03-28T08:07:20Z", "last_observed": "2019-03-28T08:07:20Z", "number_observed": 1, "object_refs": [ "url--5c9c80a8-de8c-4737-92ae-4250950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"", "osint:source-type=\"technical-report\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--5c9c80a8-de8c-4737-92ae-4250950d210f", "value": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9c9c28-b844-44bf-91d9-45c5950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T10:04:24.000Z", "modified": "2019-03-28T10:04:24.000Z", "pattern": "[email-message:from_ref.value = 'cottleakela@protonmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T10:04:24Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9c9c28-2aa0-4318-b516-44f8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T10:04:24.000Z", "modified": "2019-03-28T10:04:24.000Z", "pattern": "[email-message:from_ref.value = 'qyavauzehyco1994@o2.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T10:04:24Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5c9ca433-92e0-4c95-a054-4528950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T10:38:43.000Z", "modified": "2019-03-28T10:38:43.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"Artifacts dropped\"" ], "x_misp_category": "Artifacts dropped", "x_misp_comment": "Ransomnote", "x_misp_type": "text", "x_misp_value": "Greetings!There was a significant flaw in the security system of your company.\r\nYou should be thankful that the flaw was exploited by serious people and not some rookies.\r\nThey would have damaged all of your data by mistake or for fun.\r\n\r\nYour files are encrypted with the strongest military algorithms RSA4096 and AES-256.\r\nWithout our special decoder it is impossible to restore the data.\r\nAttempts to restore your data with third party software as Photorec, RannohDecryptor etc.\r\nwill lead to irreversible destruction of your data.\r\n\r\nTo confirm our honest intentions.\r\nSend us 2-3 different random files and you will get them decrypted.\r\nIt can be from different computers on your network to be sure that our decoder decrypts everything.\r\nSample files we unlock for free (files should not be related to any kind of backups).\r\n\r\nWe exclusively have decryption software for your situation\r\n\r\nDO NOT RESET OR SHUTDOWN - files may be damaged.\r\nDO NOT RENAME the encrypted files.\r\nDO NOT MOVE the encrypted files.\r\nThis may lead to the impossibility of recovery of the certain files.\r\n\r\nTo get information on the price of the decoder contact us at:\r\nCottleAkela@protonmail.com;QyavauZehyco1994@o2.pl\r\nThe payment has to be made in Bitcoins.\r\nThe final price depends on how fast you contact us.\r\nAs soon as we receive the payment you will get the decryption tool and\r\ninstructions on how to improve your systems security" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdbca-78dc-499a-86a2-4d6e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:35:54.000Z", "modified": "2019-03-28T14:35:54.000Z", "pattern": "[email-message:from_ref.value = 'abbschevis@protonmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:35:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdbca-0e04-42d7-ab25-4e14950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:35:54.000Z", "modified": "2019-03-28T14:35:54.000Z", "pattern": "[email-message:from_ref.value = 'ijuqodisunovib98@o2.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:35:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdcc4-d2dc-4f8c-8947-43c0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:04.000Z", "modified": "2019-03-28T14:40:04.000Z", "pattern": "[domain-name:value = 'protonmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdcc7-8654-45c7-b3b1-440b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:07.000Z", "modified": "2019-03-28T14:40:07.000Z", "pattern": "[domain-name:value = 'o2.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:07Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdccf-0b50-4881-8bfe-4b34950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:15.000Z", "modified": "2019-03-28T14:40:15.000Z", "pattern": "[email-message:from_ref.value = 'romanchukeyla@protonmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:15Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdcd0-3b78-4d12-b3c2-42ea950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:16.000Z", "modified": "2019-03-28T14:40:16.000Z", "pattern": "[email-message:from_ref.value = 'couwetizotofo@o2.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdcd0-2d68-4958-8ea1-4cc3950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:16.000Z", "modified": "2019-03-28T14:40:16.000Z", "pattern": "[email-message:from_ref.value = 'phanthavongsaneveyah@protonmail.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdcd0-4e7c-4567-a324-4a7d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:40:16.000Z", "modified": "2019-03-28T14:40:16.000Z", "pattern": "[email-message:from_ref.value = 'aperywsqaroci@o2.pl']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:40:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--5c9e39dc-a38c-422e-903f-4831950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-29T15:29:32.000Z", "modified": "2019-03-29T15:29:32.000Z", "labels": [ "misp:type=\"pattern-in-file\"", "misp:category=\"Artifacts dropped\"" ], "x_misp_category": "Artifacts dropped", "x_misp_type": "pattern-in-file", "x_misp_value": "javobohisabi yohoxucojanukazahaviwexepeniwa negikicudosoyihuruyadeyafipihaja\r\nTelawefibudi wuzahibe liga. Caku jakacoza zususezebonuli setusidafohi. Xekaho tiyiwifuvu damonixuxaho togubo\r\nxisLadoxuna pibifuzida. Goso sepudahemeli bu zevahilipezipa xurotocomupe. Kofe ridimarijoyane. Yeve.\r\nTuwipufebedopi yocomujiyezejo su su. Timevumavizase hapezo fogiju. Xonucosegogi li. Bobixayogaci. Kuyi. Leto\r\nzoyihebezobu wu ciwu. Docadufe ro judewocekodiki" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-0aa4-479e-80c5-457a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:10:25.000Z", "modified": "2019-04-01T09:10:25.000Z", "description": "C&C", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.210.136.65']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:10:25Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-97c8-4a64-aec2-46f0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T06:40:41.000Z", "modified": "2019-04-01T06:40:41.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.210.0.0/16']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T06:40:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-b02c-43ad-afbd-4f69950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:11:07.000Z", "modified": "2019-04-01T09:11:07.000Z", "description": "C&C", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.91']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:11:07Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-01f8-4c66-b7a6-4318950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T06:40:41.000Z", "modified": "2019-04-01T06:40:41.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.0/24']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T06:40:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-6478-47f0-a5cd-4e8f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:11:00.000Z", "modified": "2019-04-01T09:11:00.000Z", "description": "C&C", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.86']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:11:00Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-9670-48a3-8bbe-4639950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T06:40:41.000Z", "modified": "2019-04-01T06:40:41.000Z", "pattern": "[url:value = 'https://pastebin.com/raw/7Qmz6q5v']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T06:40:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-f7fc-4efd-9e26-4955950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:11:03.000Z", "modified": "2019-04-01T09:11:03.000Z", "description": "C&C", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.115.26.171']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:11:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b269-eb04-4df7-8a0b-41d9950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T06:40:41.000Z", "modified": "2019-04-01T06:40:41.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.115.26.0/24']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T06:40:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1ce9d-cd4c-46b6-9a6a-3ff6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T08:41:01.000Z", "modified": "2019-04-01T08:41:01.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.126.85.207']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T08:41:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1ce9d-b568-4caf-bdff-3ff6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T08:41:01.000Z", "modified": "2019-04-01T08:41:01.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.126.85.0/24']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T08:41:01Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-4e80-4388-9890-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.238.0.217']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-e228-4161-9aa7-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.105.158']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-f2a0-4fca-a92a-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.105.43']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-69b8-4968-9f67-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.21']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-1654-4bf2-b765-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.88']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-3414-41ec-9f72-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.192.108.122']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-8b64-4abe-87e7-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.192.108.123']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-121c-4714-aa3e-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.186']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-a8d8-46e0-aa54-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.83']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-6ed8-400b-b4fa-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.168']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-d90c-47f7-94c8-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.185']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cb-27c4-4c61-a7ef-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:27.000Z", "modified": "2019-04-01T09:24:27.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.184.134']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:27Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-5548-451c-9747-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.184.250']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-c67c-4701-8470-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.22']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-a450-4ef1-a1bb-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.23']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-f1c0-4dfc-85f9-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.38']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-5104-424c-bb78-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.46']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-2b0c-4ab6-9304-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.51']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-dc90-45a2-a6bf-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.53']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-fb50-48bc-8dbb-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.56']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-c190-4f11-9122-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.65']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-c2f0-469e-8883-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.77']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-0cd4-4431-a10f-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.79']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-6270-48ed-af05-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.86']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-dedc-4b55-ab68-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.92']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-3284-4bbd-a95a-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.118']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-589c-4067-adcd-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.77']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-ac04-4efc-a767-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.80']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-4df0-408a-8b83-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.84']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-f428-494a-86ac-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.45.251']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-2d24-4de1-8232-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.45.45']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-c530-4ce4-9202-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.172']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-5c10-4070-aebe-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.183']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-55a0-4f8a-baf7-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.184']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-84f4-476c-8619-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.187']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1d8cc-4490-4918-ac84-d6af950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:24:28.000Z", "modified": "2019-04-01T09:24:28.000Z", "description": "IP of server administration", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.188']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:24:28Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-87c0-4e54-891a-4dba950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '5286a5ed1288e7c54f1ca04d097f17c1d6aea32b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-c73c-48e1-91c2-4875950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '6dc00843f313690075612ee5ce770cae067cd37f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-a4c8-4094-be2e-4276950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'ee4c9567c9a072e1d8ed8a78cb06d6ce1a81dd11']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-df5c-42e5-95c1-43ca950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '2200eb3303e448a52404128458e87f3248d4612c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-2f08-4f8b-a82a-4d65950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.159']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-08fc-4585-83d4-47c7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'f0e07b689caa5c7b3767bb3b4cfe4cba2aecb5f8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-1960-4f42-89e3-4a5c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'cc9aa7e71ce04b893bcdf49a1da2f0e20e45faf2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-5a98-4ee3-afa7-48c0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '840963454567b38a5f1d1df7cd202629804e4c61']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-9dc4-4403-aaaa-406e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.58.204.177']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"ip-dst\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-1610-4df6-9bd7-4a89950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'dc8f3c31906c01d077c614809bb1195af2393dc1']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-0ebc-43d4-b476-48ea950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '02faf3e291435468607857694df5e45b68851868']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-aa0c-48ab-ac8e-4840950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '28a4481f8138c889367f9112ef48e4f17fb69944']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-fed8-4893-b9c4-4dc7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '339cdd57cfd5b141169b615ff31428782d1da639']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-e1c8-4d0d-8458-41eb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-72d0-49db-8909-4523950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '3712786dd9d1d8ac7db60ba2f989280c7257a3a9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-7dfc-43c5-864b-494c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '736a4dc679d682da321563647c60f699f0dfc268']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-4b0c-4376-89e9-4075950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = 'b1bc968bd4f49d622aa89a81f2150152a41d829c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e082-c614-431c-b553-4eff950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T09:57:22.000Z", "modified": "2019-04-01T09:57:22.000Z", "pattern": "[file:hashes.SHA1 = '15abccaae3920046f55293e25f5f931a6581e00f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T09:57:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e719-4834-41f6-be6d-4586950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:29.000Z", "modified": "2019-04-01T10:25:29.000Z", "pattern": "[domain-name:value = 'scourketchupfries.cn.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e719-db18-46a6-9d1c-4acc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:29.000Z", "modified": "2019-04-01T10:25:29.000Z", "pattern": "[file:name = 'vds58339.localdomain']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e719-819c-451a-9977-400e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:29.000Z", "modified": "2019-04-01T10:25:29.000Z", "pattern": "[email-message:from_ref.value = 'root@vds58339.localdomain']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e719-ffe4-4586-9f65-4c75950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:29.000Z", "modified": "2019-04-01T10:25:29.000Z", "pattern": "[file:name = 'localhost.localdomain']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e719-0af8-451f-9ab5-4828950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:29.000Z", "modified": "2019-04-01T10:25:29.000Z", "pattern": "[email-message:from_ref.value = 'root@localhost.localdomain']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:29Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"email-src\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e71a-e47c-45fa-95f8-4ebc950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:30.000Z", "modified": "2019-04-01T10:25:30.000Z", "pattern": "[domain-name:value = 'www.csgolite.ru']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e71a-eb68-4e2f-afb1-405c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:30.000Z", "modified": "2019-04-01T10:25:30.000Z", "pattern": "[domain-name:value = 'tcp.csgolite.ru']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1e71a-4378-412c-acbe-499f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T10:25:30.000Z", "modified": "2019-04-01T10:25:30.000Z", "pattern": "[domain-name:value = 'bendermoney.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T10:25:30Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca21226-bc58-47e2-bc18-4c09950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T13:29:10.000Z", "modified": "2019-04-01T13:29:10.000Z", "pattern": "[url:value = 'https://pastebin.com/raw/wdcq0Tda']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T13:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca21226-ff2c-4002-91db-40b4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T13:29:10.000Z", "modified": "2019-04-01T13:29:10.000Z", "pattern": "[url:value = 'https://pastebin.com/raw/9ditgTZh']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T13:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca21226-c4bc-43b0-b0da-40a8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-01T13:29:10.000Z", "modified": "2019-04-01T13:29:10.000Z", "pattern": "[url:value = 'https://pastebin.com/Mzd1HFrN']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-01T13:29:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca61559-4fd4-4df0-976e-43ba950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:31:53.000Z", "modified": "2019-04-04T14:31:53.000Z", "pattern": "[file:hashes.IMPHASH = 'c226ac4bab6f48634bacbb7a1d34f8f6']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:31:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"imphash\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:46.000Z", "modified": "2019-04-04T11:02:46.000Z", "pattern": "[file:hashes.MD5 = '52340664fe59e030790c48b66924b5bd' AND file:hashes.SHA1 = '73171ffa6dfee5f9264e3d20a1b6926ec1b60897' AND file:hashes.SHA256 = 'bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9c882a-a40c-46db-a3f5-f383950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T08:39:06.000Z", "modified": "2019-03-28T08:39:06.000Z", "pattern": "[file:name = 'README-NOW.txt' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T08:39:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:46.000Z", "modified": "2019-04-04T11:02:46.000Z", "pattern": "[file:hashes.MD5 = '164f72dfb729ca1e15f99d456b7cf811' AND file:hashes.SHA1 = 'f92339e73c7e901c0c852d8e65615cfb588a4ff6' AND file:hashes.SHA256 = '8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:46.000Z", "modified": "2019-04-04T11:02:46.000Z", "pattern": "[file:hashes.MD5 = '9cad8641ac79688e09c5fa350aef2094' AND file:hashes.SHA1 = '3da0a217bbda09561780f52f163a6aafeb721d60' AND file:hashes.SHA256 = '5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:46.000Z", "modified": "2019-04-04T11:02:46.000Z", "pattern": "[file:hashes.MD5 = '3ebca21b1d4e2f482b3eda6634e89211' AND file:hashes.SHA1 = '37cdd1e3225f8da596dc13779e902d8d13637360' AND file:hashes.SHA256 = '6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:46.000Z", "modified": "2019-04-04T11:02:46.000Z", "pattern": "[file:hashes.MD5 = 'a5bc1f94e7505a2e73c866551f7996f9' AND file:hashes.SHA1 = '7dea7ff735023418b902d093964028aefbc486a5' AND file:hashes.SHA256 = '14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'a1d732aa27e1ca2ae45a189451419ed5' AND file:hashes.SHA1 = '50f5a5ec13d21d4df119140547d63bc40f93b079' AND file:hashes.SHA256 = 'c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'b3d3da12ca3b9efd042953caa6c3b8cd' AND file:hashes.SHA1 = '34fb03a35e723d27e99776ed3e81967229b3afe1' AND file:hashes.SHA256 = '7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'faf4de4e1c5d8e4241088c90cfe8eddd' AND file:hashes.SHA1 = 'fcd241fdcd462199f2907ca34c73ce9c89b03e5f' AND file:hashes.SHA256 = '47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9cdeef-4adc-461d-9b72-4062950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-03-28T14:49:19.000Z", "modified": "2019-03-28T14:49:19.000Z", "pattern": "[file:name = 'READ-ME-NOW.txt' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:parent_directory_ref.path = 'E:\\\\goga\\\\' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-03-28T14:49:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = '174e3d9c7b0380dd7576187c715c4681' AND file:hashes.SHA1 = '31fbfe814628db3b459ddc87bf5ed538700db17a' AND file:hashes.SHA256 = 'c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'a52f26575556d3c4eccd3b51265cb4e6' AND file:hashes.SHA1 = '61fdebb3c9dfa880b54e82579256acfcd4d6d406' AND file:hashes.SHA256 = '97a2ab7a94148d605f3c0a1146a70ba5c436a438b23298a1f02f71866f420c43' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'ba53d8910ec3e46864c3c86ebd628796' AND file:hashes.SHA1 = 'd1c2dfedc602f5d5f2036b0ba5541cac8f8b4b95' AND file:hashes.SHA256 = 'a84171501074bac584348f2942964c8550374c39247ec6af0f4a69756ea9fc7a' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9e3b43-3128-4838-8d63-4a69950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = '871aa15f4d61c85e1284e1be3f99f705' AND file:hashes.SHA1 = '236eac0b19f91117b27f1b198a4d8490d99ec2e5' AND file:hashes.SHA256 = 'b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = '34187a34d0a3c5d63016c26346371b54' AND file:hashes.SHA1 = 'ce8209ff9828aa8cb095bd7d1589fc4d394c298c' AND file:hashes.SHA256 = '5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3' AND file:name = 'kill.bat' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = '644087ccca16d2a728ef7685a4106f09' AND file:hashes.SHA1 = 'eabd6974ac71efd72d9e0688d5a6131f336d169c' AND file:hashes.SHA256 = '385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e' AND file:name = 'cob93.exe' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = '7b792de1468a70cfe990b65034d5f3ac' AND file:hashes.SHA1 = '320f1fc66054e98681fd291415ff17b2e1a71b61' AND file:hashes.SHA256 = 'a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b' AND file:name = 'test.bat' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--5ca5e3be-9cc4-4a68-939e-bac6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:00:14.000Z", "modified": "2019-04-04T11:00:14.000Z", "pattern": "[file:hashes.MD5 = '06457b317d5624590803a77d3770bff2' AND file:name = 'AD.zip' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:size = '472243' AND file:x_misp_state = 'Malicious']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:00:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:47.000Z", "modified": "2019-04-04T11:02:47.000Z", "pattern": "[file:hashes.MD5 = 'ecf535c505b7752b0af188a915a23786' AND file:hashes.SHA1 = '736a4dc679d682da321563647c60f699f0dfc268' AND file:hashes.SHA256 = 'bfdf4cf3f143ad0db912d8ab3a7c12f617b9ea60ce8b1f4e44f74270fb21b19b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2018-12-05 00:08:31", "category": "Other", "uuid": "a3fa831d-a38e-413e-bb19-1910b97fec2a" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/bfdf4cf3f143ad0db912d8ab3a7c12f617b9ea60ce8b1f4e44f74270fb21b19b/analysis/1543968511/", "category": "Payload delivery", "uuid": "7ad826d7-4477-4290-9dd7-a0d29a060c1f" }, { "type": "text", "object_relation": "detection-ratio", "value": "0/58", "category": "Payload delivery", "uuid": "f0291f05-fdde-4969-8684-db393699dea4" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "pattern": "[file:hashes.MD5 = '83e10465b722ef33ff0b6f535e8d996b' AND file:hashes.SHA1 = '339cdd57cfd5b141169b615ff31428782d1da639' AND file:hashes.SHA256 = '02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-03 11:56:47", "category": "Other", "uuid": "f59d8322-50b5-4d3b-a2e4-eb219bcf694b" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0/analysis/1554292607/", "category": "Payload delivery", "uuid": "270cedd4-baf8-4281-b6fc-0f949fc211ca" }, { "type": "text", "object_relation": "detection-ratio", "value": "0/58", "category": "Payload delivery", "uuid": "ebb52bad-6f2a-4b1b-a485-43be41a61f93" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "pattern": "[file:hashes.MD5 = '1d3554048578b03f42424dbf20730a3f' AND file:hashes.SHA1 = '02faf3e291435468607857694df5e45b68851868' AND file:hashes.SHA256 = '687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-03-30 09:28:42", "category": "Other", "uuid": "3576524b-3254-41ac-ac75-478ebe162909" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2/analysis/1553938122/", "category": "Payload delivery", "uuid": "f5c8e926-2ac1-49ef-8bb4-6f237baaf112" }, { "type": "text", "object_relation": "detection-ratio", "value": "0/58", "category": "Payload delivery", "uuid": "458c15ba-a1ca-4e47-8901-0500a4203afc" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "pattern": "[file:hashes.MD5 = '1edaf9ae99ce2920667d0e9a8b3f8c9c' AND file:hashes.SHA1 = 'f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0' AND file:hashes.SHA256 = '4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-03-20 15:20:14", "category": "Other", "uuid": "615d556b-f37c-400f-88e2-020eb673be6d" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da/analysis/1553095214/", "category": "Payload delivery", "uuid": "3b2c4cbb-41d9-4954-b0dd-4b6a52b87303" }, { "type": "text", "object_relation": "detection-ratio", "value": "0/54", "category": "Payload delivery", "uuid": "8d33693b-a8e3-4c60-9df0-6bb18c7686e8" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:48.000Z", "modified": "2019-04-04T11:02:48.000Z", "pattern": "[file:hashes.MD5 = '3e455215095192e1b75d379fb187298a' AND file:hashes.SHA1 = 'b1bc968bd4f49d622aa89a81f2150152a41d829c' AND file:hashes.SHA256 = 'ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T11:02:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-02-28 21:20:19", "category": "Other", "uuid": "a5771217-664e-468a-b883-963967688281" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99/analysis/1551388819/", "category": "Payload delivery", "uuid": "5c9d5e47-d971-4bd4-a0e2-55df09eb31f0" }, { "type": "text", "object_relation": "detection-ratio", "value": "0/54", "category": "Payload delivery", "uuid": "9b3526d2-e054-419d-b3f6-b36588aa00fb" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:10:19", "category": "Other", "uuid": "c221b793-ca91-4ea5-9ba9-3a08b8d153b0" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29/analysis/1554361819/", "category": "Payload delivery", "uuid": "e62b032c-b748-43cf-9663-7bf43b7c811e" }, { "type": "text", "object_relation": "detection-ratio", "value": "49/68", "category": "Payload delivery", "uuid": "0903cfac-7124-4138-b7ca-350ccf89ef78" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-03 10:15:05", "category": "Other", "uuid": "95dd2a05-d5e2-4ca5-9b63-950965df87d7" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b/analysis/1554286505/", "category": "Payload delivery", "uuid": "92fa1fda-791f-4245-b42c-bf14fc0fb1d5" }, { "type": "text", "object_relation": "detection-ratio", "value": "21/58", "category": "Payload delivery", "uuid": "9e9cd2ac-2699-4da9-befb-53651ad2aaa6" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-03 10:14:59", "category": "Other", "uuid": "8a4b82c6-9892-4c00-9855-b521648e574a" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4/analysis/1554286499/", "category": "Payload delivery", "uuid": "c8a542e8-a2cb-4cf9-a070-d0b25ee49519" }, { "type": "text", "object_relation": "detection-ratio", "value": "52/71", "category": "Payload delivery", "uuid": "9263cb76-ef44-45ae-972c-fe3b90a4b2ff" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 06:54:10", "category": "Other", "uuid": "5871b620-bb9b-4dc1-ac8f-2f1c4e0840fd" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e/analysis/1554360850/", "category": "Payload delivery", "uuid": "1e73fc65-f7ce-4262-8463-0f80f93da9ae" }, { "type": "text", "object_relation": "detection-ratio", "value": "53/70", "category": "Payload delivery", "uuid": "796a7fb7-65cf-4b5f-85a8-0a097520d3cb" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:24:59", "category": "Other", "uuid": "112fad1f-774e-4b50-8947-9657406c3627" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca/analysis/1554362699/", "category": "Payload delivery", "uuid": "8b0c280c-7c10-4b30-9fd0-4c073c4ea048" }, { "type": "text", "object_relation": "detection-ratio", "value": "56/71", "category": "Payload delivery", "uuid": "b138d431-1a16-4779-813e-b149a3421b4b" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:49.000Z", "modified": "2019-04-04T11:02:49.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 06:59:47", "category": "Other", "uuid": "96719cd4-a3be-42f9-9edd-7551a3d10efa" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3/analysis/1554361187/", "category": "Payload delivery", "uuid": "7f6155ce-dd15-474a-9b1e-b183b029e656" }, { "type": "text", "object_relation": "detection-ratio", "value": "10/57", "category": "Payload delivery", "uuid": "33b779b8-ad32-4a69-8bbd-9fe21046e36b" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-01 16:37:44", "category": "Other", "uuid": "7d9c017b-8edd-49dd-ac87-83ede8411029" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4/analysis/1554136664/", "category": "Payload delivery", "uuid": "e9bd4bc8-d8ec-4185-90ed-7e5786a6bce9" }, { "type": "text", "object_relation": "detection-ratio", "value": "43/71", "category": "Payload delivery", "uuid": "83263b7e-8059-46d2-8b99-5b0b43a37e90" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:05:59", "category": "Other", "uuid": "4553a71a-776c-4461-8a66-c7cd64e44318" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a/analysis/1554361559/", "category": "Payload delivery", "uuid": "da933654-16fb-498a-8640-44e69146f078" }, { "type": "text", "object_relation": "detection-ratio", "value": "45/61", "category": "Payload delivery", "uuid": "a03d25eb-08d2-4ff8-87b8-e8f2c98eb179" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-02 23:51:08", "category": "Other", "uuid": "b5672881-9c3c-44f9-8db2-298d466a4dd9" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/97a2ab7a94148d605f3c0a1146a70ba5c436a438b23298a1f02f71866f420c43/analysis/1554249068/", "category": "Payload delivery", "uuid": "ed5167e6-ce8b-4816-888d-18b7cf9a9b4f" }, { "type": "text", "object_relation": "detection-ratio", "value": "44/72", "category": "Payload delivery", "uuid": "a4480342-e0bc-4292-bd67-5bcbe6369375" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-02 23:53:36", "category": "Other", "uuid": "19057350-70ca-4b61-bf3a-ccfe54f0490a" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/a84171501074bac584348f2942964c8550374c39247ec6af0f4a69756ea9fc7a/analysis/1554249216/", "category": "Payload delivery", "uuid": "021bca0d-21c1-4af3-ad1d-9ede46c96d73" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/68", "category": "Payload delivery", "uuid": "1d711364-ad24-4f60-a406-579fc420984f" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:16:09", "category": "Other", "uuid": "a3ef3a8c-2c5b-469a-ba3a-232ea3d646b4" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c/analysis/1554362169/", "category": "Payload delivery", "uuid": "3431a2b3-15e0-4e7b-81e8-3a8a4467c58a" }, { "type": "text", "object_relation": "detection-ratio", "value": "53/70", "category": "Payload delivery", "uuid": "2fd75f6e-a29d-4193-83af-07e23cc7565e" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-03 17:13:07", "category": "Other", "uuid": "101cf662-c46e-4335-8eef-189b488e4a31" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262/analysis/1554311587/", "category": "Payload delivery", "uuid": "15db5590-265b-4922-b1fd-352d2725bebc" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/66", "category": "Payload delivery", "uuid": "93ca72df-1be0-455f-a1cd-cf769e550da5" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:50.000Z", "modified": "2019-04-04T11:02:50.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:26:59", "category": "Other", "uuid": "0023fe73-0980-46e0-9556-46bbfe5fdec4" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125/analysis/1554362819/", "category": "Payload delivery", "uuid": "383e14be-cdda-4969-99ae-3adae2fa7b7f" }, { "type": "text", "object_relation": "detection-ratio", "value": "51/68", "category": "Payload delivery", "uuid": "ab2852d7-9aae-4a0f-aa4b-549583563ce7" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:21:45", "category": "Other", "uuid": "d4aea7f7-e340-4e76-89c1-2546884db901" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f/analysis/1554362505/", "category": "Payload delivery", "uuid": "bcc766b7-352e-4241-b3ba-4dab52c02065" }, { "type": "text", "object_relation": "detection-ratio", "value": "55/70", "category": "Payload delivery", "uuid": "401b939c-ce2c-426b-9505-0554136fa85c" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "x-misp-object", "spec_version": "2.1", "id": "x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "labels": [ "misp:name=\"virustotal-report\"", "misp:meta-category=\"misc\"" ], "x_misp_attributes": [ { "type": "datetime", "object_relation": "last-submission", "value": "2019-04-04 07:20:30", "category": "Other", "uuid": "29971556-1f8f-491a-bc22-607f26e0cdcf" }, { "type": "link", "object_relation": "permalink", "value": "https://www.virustotal.com/file/6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77/analysis/1554362430/", "category": "Payload delivery", "uuid": "088b3a1d-f7d5-4bf0-9998-7fa00b4d1177" }, { "type": "text", "object_relation": "detection-ratio", "value": "55/71", "category": "Payload delivery", "uuid": "de0d2c55-e16b-426a-95ef-f04995cada4f" } ], "x_misp_meta_category": "misc", "x_misp_name": "virustotal-report" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b6346b5e-5482-4314-9d7b-8671c4155bf1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:08:41.000Z", "modified": "2019-04-04T14:08:41.000Z", "pattern": "[file:hashes.SHA1 = '2a030cc6d84d5785f5e84d0f5888a411d4b06d01' AND file:name = 'soft.exe' AND file:size = '45568']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:08:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d74356f9-39d2-4c30-9711-8ed1a401acd3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:42.000Z", "modified": "2019-04-04T14:11:42.000Z", "pattern": "[file:hashes.SHA1 = '2abae839362edfe52d9ebe282fb61113d22b331f' AND file:name = 'sttager.exe' AND file:size = '20480']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:42Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--e668ce8c-af43-4832-89b2-9c08e3f5124c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:42.000Z", "modified": "2019-04-04T14:11:42.000Z", "pattern": "[file:hashes.SHA1 = '6995a32e0a4d4f6d0c9b2a00a96d69bff4b83ea7' AND file:name = 'test443.exe' AND file:size = '373911']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:42Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6e1a65fa-acb6-4ea6-a06b-636c428138b5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:43.000Z", "modified": "2019-04-04T14:11:43.000Z", "pattern": "[file:hashes.SHA1 = '87b1f17fbb4a1e8eef4cb31c1c0194b1426c868c' AND file:name = 'veil.exe' AND file:size = '345761']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:43Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f7e26e48-37f4-45a8-8a1c-2ecc11dec53a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:43.000Z", "modified": "2019-04-04T14:11:43.000Z", "pattern": "[file:hashes.SHA1 = 'afc36916a4df934446681ea28bef6add4decb98a' AND file:name = '80_http.exe.exe' AND file:size = '411850']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:43Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d4db8abd-f691-4927-9e28-14ce0ee7d430", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:43.000Z", "modified": "2019-04-04T14:11:43.000Z", "pattern": "[file:hashes.SHA1 = 'f832d94391a8d2d5cf92773e6c912905ec7c40c7' AND file:name = 'test1.exe' AND file:size = '406636']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:43Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3d49a49b-5bc6-49be-a0e6-ab3b72ccfe46", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:44.000Z", "modified": "2019-04-04T14:11:44.000Z", "pattern": "[file:hashes.SHA1 = '056823c7891a04b2fec8903eb401ae3291743a54' AND file:name = 'beca.exe.exe' AND file:size = '23808']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f898f5e1-93e1-458b-996c-ebc6dba13222", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:44.000Z", "modified": "2019-04-04T14:11:44.000Z", "pattern": "[file:hashes.SHA1 = 'b7afa7acf1b7ded2c4e3d0884b5cdaa230d9f82e' AND file:name = 'shell1.exe' AND file:size = '24576']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:44Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--89b53bf3-e0c4-4f48-8e25-ff54844fae43", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:45.000Z", "modified": "2019-04-04T14:11:45.000Z", "pattern": "[file:hashes.SHA1 = '4b50b6b9157026ab408d966ece02d1cef8045f82' AND file:name = 'starggge.exe' AND file:size = '27136']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--1162a78a-804d-4856-82b3-0b77509bcfe7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:45.000Z", "modified": "2019-04-04T14:11:45.000Z", "pattern": "[file:hashes.SHA1 = '6042dfd50d33da40e383baec4a7ef7c75bf17481' AND file:name = '8_32.exe' AND file:size = '24064']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--bf5439e4-3e35-44a0-9ff3-129042947aad", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:45.000Z", "modified": "2019-04-04T14:11:45.000Z", "pattern": "[file:hashes.SHA1 = '9b50fae63f4d8d402f30c487ca7216f610413642' AND file:name = 'payload.exe' AND file:size = '6144']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:45Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--02af3be3-4a7e-4a84-81eb-83f604a3f0a5", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:46.000Z", "modified": "2019-04-04T14:11:46.000Z", "pattern": "[file:hashes.SHA1 = '781778f789185889259d2a8dec981e80098fa490' AND file:name = '443_12.exe' AND file:size = '28904']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dae97fa0-3eb3-4915-82cc-e7e489d64dd1", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:46.000Z", "modified": "2019-04-04T14:11:46.000Z", "pattern": "[file:hashes.SHA1 = '153d37f0f0660734a1e05cb67721c4ceff54919f' AND file:name = 'test.exe' AND file:size = '370807']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--24e6319c-f91c-43b2-a9d3-7b0bfd5a76a7", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:47.000Z", "modified": "2019-04-04T14:11:47.000Z", "pattern": "[file:hashes.SHA1 = '2d038fcd5987b2e7008b2e269b0a9ff968063ee8' AND file:name = 'test_1.exe' AND file:size = '601039']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3dac003b-a958-48e2-8a96-6d0fdba7875d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:47.000Z", "modified": "2019-04-04T14:11:47.000Z", "pattern": "[file:hashes.SHA1 = '9d2148cd22c245fc3ba7861a560d223f72f34414' AND file:name = 'synack_network_noinject_x86.ps1' AND file:size = '302611']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c01e648d-7f49-45f7-b7d7-48ce5a507a47", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:48.000Z", "modified": "2019-04-04T14:11:48.000Z", "pattern": "[file:hashes.SHA1 = 'c8207144f89c9d775ff5565888dbbc8167e09330' AND file:name = 'synack_network_noinject_x64.ps1' AND file:size = '390311']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:48Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--ac91f1d9-024c-44e2-8a7c-06172796ea12", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:49.000Z", "modified": "2019-04-04T14:11:49.000Z", "pattern": "[file:hashes.SHA1 = '5131a7a011041e88b32a2a98e5170c42d5c57250' AND file:name = 'synack_network_x64.ps1' AND file:size = '423995']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:49Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--2ba4112d-7327-4b19-8035-a2e6eb73d573", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:50.000Z", "modified": "2019-04-04T14:11:50.000Z", "pattern": "[file:hashes.SHA1 = 'e925c3ba15f007363ad32b84df7da9b299b9b100' AND file:name = 'synack_x64.ps1' AND file:size = '423995']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:50Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7f430f07-3ff9-4553-b81a-36681949c447", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:51.000Z", "modified": "2019-04-04T14:11:51.000Z", "pattern": "[file:hashes.SHA1 = '481b18bcbd9d32c5363bb56ab212d57d78497c05' AND file:name = 'synack_network_x86.ps1' AND file:size = '327187']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--6fe2ec22-3ff6-4a79-af8e-30e6a5253e45", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:51.000Z", "modified": "2019-04-04T14:11:51.000Z", "pattern": "[file:hashes.SHA1 = '2bcfd0679726f0110545b47b4512a8a4ddcb830f' AND file:name = 'synack_x86.ps1' AND file:size = '327187']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:51Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--b14e7307-30f6-49c8-b4fe-0b6735a3a94d", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:52.000Z", "modified": "2019-04-04T14:11:52.000Z", "pattern": "[file:hashes.SHA1 = 'eaefb5e9ea2e0d301ee594e6358ea136442cd075' AND file:name = 'test.exe' AND file:size = '529477']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--3549d1ed-c1c7-4066-a9cc-9d0a86cd8e0a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:52.000Z", "modified": "2019-04-04T14:11:52.000Z", "pattern": "[file:hashes.SHA1 = '237b19af7c867b21f46793dd7257dff2f3be1513' AND file:name = 'encryptor.zip' AND file:size = '18211']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--eaa8dc3c-16ef-45eb-add4-3d736d1bd330", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:52.000Z", "modified": "2019-04-04T14:11:52.000Z", "pattern": "[file:hashes.SHA1 = 'f5619064f2d8aebfdba0fc3f566cb60f599f9f6e' AND file:name = 'encryptor.exe' AND file:size = '29696']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:52Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7e91cd8c-c822-43fe-ac0b-5d137f57bc3a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:11:53.000Z", "modified": "2019-04-04T14:11:53.000Z", "pattern": "[file:hashes.SHA1 = '399d4d5ab0bdbe0b1a61bac007d56adff005486d' AND file:name = 'tung2901_AU3_EXE_6cr22.rar' AND file:size = '277412']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:11:53Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--7b59d923-d374-41bc-89b7-e68498bacc72", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:34.000Z", "modified": "2019-04-04T14:19:34.000Z", "pattern": "[file:hashes.MD5 = '644087ccca16d2a728ef7685a4106f09' AND file:hashes.SHA1 = 'eabd6974ac71efd72d9e0688d5a6131f336d169c' AND file:hashes.SHA256 = '385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:34Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--4b9fdc52-1ce3-45d7-85cc-60215eb30f0c", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:34.000Z", "modified": "2019-04-04T14:19:34.000Z", "pattern": "[file:hashes.MD5 = '34187a34d0a3c5d63016c26346371b54' AND file:hashes.SHA1 = 'ce8209ff9828aa8cb095bd7d1589fc4d394c298c' AND file:hashes.SHA256 = '5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:34Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--fa63b93f-2201-4f6c-8341-4a86980805b3", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:35.000Z", "modified": "2019-04-04T14:19:35.000Z", "pattern": "[file:hashes.MD5 = '871aa15f4d61c85e1284e1be3f99f705' AND file:hashes.SHA1 = '236eac0b19f91117b27f1b198a4d8490d99ec2e5' AND file:hashes.SHA256 = 'b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--c73504a4-60da-4107-adef-c10a0f52266b", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:35.000Z", "modified": "2019-04-04T14:19:35.000Z", "pattern": "[file:hashes.MD5 = 'a1d732aa27e1ca2ae45a189451419ed5' AND file:hashes.SHA1 = '50f5a5ec13d21d4df119140547d63bc40f93b079' AND file:hashes.SHA256 = 'c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:35Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--edbac896-cf24-4628-9064-7bac3c8e8d58", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:36.000Z", "modified": "2019-04-04T14:19:36.000Z", "pattern": "[file:hashes.MD5 = '164f72dfb729ca1e15f99d456b7cf811' AND file:hashes.SHA1 = 'f92339e73c7e901c0c852d8e65615cfb588a4ff6' AND file:hashes.SHA256 = '8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--d91eacd1-efda-4eaf-ae5a-f815869b10dd", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:36.000Z", "modified": "2019-04-04T14:19:36.000Z", "pattern": "[file:hashes.MD5 = '9cad8641ac79688e09c5fa350aef2094' AND file:hashes.SHA1 = '3da0a217bbda09561780f52f163a6aafeb721d60' AND file:hashes.SHA256 = '5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--a1a25873-3445-4873-8b6b-7dca2e15615a", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:36.000Z", "modified": "2019-04-04T14:19:36.000Z", "pattern": "[file:hashes.MD5 = '3ebca21b1d4e2f482b3eda6634e89211' AND file:hashes.SHA1 = '37cdd1e3225f8da596dc13779e902d8d13637360' AND file:hashes.SHA256 = '6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--9aa33ad7-9f08-4774-b109-cedaed81cd60", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:37.000Z", "modified": "2019-04-04T14:19:37.000Z", "pattern": "[file:hashes.MD5 = '52340664fe59e030790c48b66924b5bd' AND file:hashes.SHA1 = '73171ffa6dfee5f9264e3d20a1b6926ec1b60897' AND file:hashes.SHA256 = 'bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:37Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--dc691061-1ee8-46b1-b3ef-488f082e45c8", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:38.000Z", "modified": "2019-04-04T14:19:38.000Z", "pattern": "[file:hashes.MD5 = 'a5bc1f94e7505a2e73c866551f7996f9' AND file:hashes.SHA1 = '7dea7ff735023418b902d093964028aefbc486a5' AND file:hashes.SHA256 = '14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--8d31887c-d4a7-4e7f-899c-df1d3a41e15f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:38.000Z", "modified": "2019-04-04T14:19:38.000Z", "pattern": "[file:hashes.MD5 = 'b3d3da12ca3b9efd042953caa6c3b8cd' AND file:hashes.SHA1 = '34fb03a35e723d27e99776ed3e81967229b3afe1' AND file:hashes.SHA256 = '7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--febd2cf8-35c9-49d2-9963-21b43acb6f04", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:39.000Z", "modified": "2019-04-04T14:19:39.000Z", "pattern": "[file:hashes.MD5 = 'faf4de4e1c5d8e4241088c90cfe8eddd' AND file:hashes.SHA1 = 'fcd241fdcd462199f2907ca34c73ce9c89b03e5f' AND file:hashes.SHA256 = '47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--f63b62d9-f5f1-4c51-9488-139d016e7660", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2019-04-04T14:19:39.000Z", "modified": "2019-04-04T14:19:39.000Z", "pattern": "[file:hashes.MD5 = '7b792de1468a70cfe990b65034d5f3ac' AND file:hashes.SHA1 = '320f1fc66054e98681fd291415ff17b2e1a71b61' AND file:hashes.SHA256 = 'a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2019-04-04T14:19:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "file" } ], "labels": [ "misp:name=\"file\"", "misp:meta-category=\"file\"", "misp:to_ids=\"True\"" ] }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--befab1a1-2b4a-4540-952a-922278cf82c0", "created": "2019-03-28T08:39:21.000Z", "modified": "2019-03-28T08:39:21.000Z", "relationship_type": "creator-of", "source_ref": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f", "target_ref": "indicator--5c9c882a-a40c-46db-a3f5-f383950d210f" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d6c71559-29b0-48dd-9236-20c9f79ac1e1", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f", "target_ref": "x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9aad7daf-6c59-4867-ba46-3232293ee3a8", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f", "target_ref": "x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--724f2840-888d-4639-85c8-a1eca39cc5ca", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f", "target_ref": "x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--0a6c6598-6f22-4d03-af41-5e2cdf61caae", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f", "target_ref": "x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9af6cf96-af83-44ac-81a6-f8fbbcd8ce22", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f", "target_ref": "x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--a0a026c0-bd52-480a-9e06-184b87fccd01", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f", "target_ref": "x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--b82b8365-592c-429b-b8be-8b675cf76c24", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f", "target_ref": "x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--c8739605-5978-45e9-bdee-187564723288", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f", "target_ref": "x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--20d02435-b817-4bf1-9c03-bddbd24b0212", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f", "target_ref": "x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--419f5108-66d9-4623-b8a6-0d56789b4d9f", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f", "target_ref": "x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--96177536-f8e7-4ffb-8771-69feda28cc02", "created": "2019-04-04T11:02:51.000Z", "modified": "2019-04-04T11:02:51.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f", "target_ref": "x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--f9305cde-1e4d-45bd-a0ca-cc4176c807fb", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9e3b43-3128-4838-8d63-4a69950d210f", "target_ref": "x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9afb5fff-3b1d-42e8-9c36-9c612422b106", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f", "target_ref": "x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--cd469e0b-49ca-4af6-8603-4f2297e9cc79", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f", "target_ref": "x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--9304643c-6881-41e3-9198-04c65d84152b", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f", "target_ref": "x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--1a430efa-100e-405b-8264-4b85ee5665dc", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a", "target_ref": "x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--4b98aec3-9c78-4ac5-aee1-24e43314c48f", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1", "target_ref": "x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--d5fa14a8-ad21-4a78-8857-f209ef41a16a", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18", "target_ref": "x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--215abfc9-1d9c-482b-9b7e-0439fb0c579f", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033", "target_ref": "x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9" }, { "type": "relationship", "spec_version": "2.1", "id": "relationship--948a3baa-9eed-495e-8bb6-aa62dd820348", "created": "2019-04-04T11:02:52.000Z", "modified": "2019-04-04T11:02:52.000Z", "relationship_type": "analysed-with", "source_ref": "indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216", "target_ref": "x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab" }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }