{ "type": "bundle", "id": "bundle--57a88345-5254-4c97-954d-4ff8950d210f", "objects": [ { "type": "identity", "spec_version": "2.1", "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-09T13:57:10.000Z", "modified": "2016-08-09T13:57:10.000Z", "name": "CIRCL", "identity_class": "organization" }, { "type": "report", "spec_version": "2.1", "id": "report--57a88345-5254-4c97-954d-4ff8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-09T13:57:10.000Z", "modified": "2016-08-09T13:57:10.000Z", "name": "OSINT - Strider: Cyberespionage group turns eye of Sauron on targets", "published": "2016-08-09T13:57:21Z", "object_refs": [ "observed-data--57a88352-7acc-4ad7-be40-453d950d210f", "url--57a88352-7acc-4ad7-be40-453d950d210f", "x-misp-attribute--57a8837a-a450-4ced-b08e-4905950d210f", "x-misp-attribute--57a883b4-fabc-4936-8e65-41c8950d210f", "x-misp-attribute--57a88419-1900-403e-845c-47da950d210f", "x-misp-attribute--57a8841a-455c-4b87-96a5-4325950d210f", "x-misp-attribute--57a8841a-a3cc-457b-9a54-4e8c950d210f", "x-misp-attribute--57a8841a-f964-41c4-81a5-43e4950d210f", "indicator--57a88454-b0c4-432b-ae28-4558950d210f", "observed-data--57a885bc-1614-4e58-8e17-4457950d210f", "url--57a885bc-1614-4e58-8e17-4457950d210f", "indicator--57a885fd-10f8-46fe-8f9d-44ca950d210f", "indicator--57a88670-859c-439a-bd1d-4e63950d210f", "indicator--57a886ca-69c8-45d6-80ed-41fb950d210f", "indicator--57a88713-13ec-49db-a8cf-4ccb950d210f", "indicator--57a88713-03d0-4507-a60c-4d2f950d210f", "indicator--57a88726-e6ec-4913-926b-44f102de0b81", "indicator--57a88727-5970-4226-a94e-412602de0b81", "observed-data--57a88727-6cfc-4135-9911-471d02de0b81", "url--57a88727-6cfc-4135-9911-471d02de0b81", "indicator--57a88728-93e0-497c-b71b-438402de0b81", "indicator--57a88728-fd5c-4297-be69-470b02de0b81", "observed-data--57a88729-dd00-4f3f-8a83-4f6602de0b81", "url--57a88729-dd00-4f3f-8a83-4f6602de0b81", "indicator--57a88830-f1b4-4a1e-b841-4c5c950d210f", "indicator--57a8886b-ba78-49a2-aadb-48cd950d210f", "indicator--57a888a3-e1b0-4996-a918-4eca950d210f", "indicator--57a888f0-ad44-4490-9f2f-4486950d210f", "indicator--57a88918-641c-44a7-8ab9-453b950d210f", "indicator--57a88918-cf7c-4e27-8853-4557950d210f", "indicator--57a88918-57d0-44b7-88a5-4a1b950d210f", "indicator--57a88918-6ac0-43b5-a57a-485e950d210f", "indicator--57a88919-2298-4047-9466-4583950d210f", "indicator--57a88919-8ba4-40f1-99fa-4e7b950d210f", "indicator--57a88919-a6bc-4fea-910b-4aad950d210f", "indicator--57a8892e-d428-466b-b840-469c02de0b81", "indicator--57a8892e-7f90-4990-85ac-49ae02de0b81", "observed-data--57a8892e-ef88-415d-80e0-498e02de0b81", "url--57a8892e-ef88-415d-80e0-498e02de0b81", "indicator--57a8892f-cc04-4152-9128-4b7302de0b81", "indicator--57a8892f-711c-446a-80a1-497e02de0b81", "observed-data--57a8892f-24c4-458c-bc44-45d802de0b81", "url--57a8892f-24c4-458c-bc44-45d802de0b81", "indicator--57a8892f-c620-4e9f-915d-4c2b02de0b81", "indicator--57a8892f-3c50-45a8-a921-4c8102de0b81", "observed-data--57a88930-d4d4-49f5-8125-433502de0b81", "url--57a88930-d4d4-49f5-8125-433502de0b81", "indicator--57a88930-0918-4973-8a8e-454b02de0b81", "indicator--57a88930-cfa4-41f9-96bd-40e802de0b81", "observed-data--57a88930-0520-41f5-adf5-4ba602de0b81", "url--57a88930-0520-41f5-adf5-4ba602de0b81", "indicator--57a88931-8c58-4ed9-9396-471902de0b81", "indicator--57a88931-ad84-4ded-b269-4cc802de0b81", "observed-data--57a88931-d260-41f7-97d5-462202de0b81", "url--57a88931-d260-41f7-97d5-462202de0b81", "indicator--57a88931-c5f0-4ac8-8a8d-4dda02de0b81", "indicator--57a88931-6a54-4009-af93-4c9002de0b81", "observed-data--57a88932-3ecc-484f-ab05-472002de0b81", "url--57a88932-3ecc-484f-ab05-472002de0b81", "indicator--57a88932-98c0-474a-aaae-442002de0b81", "indicator--57a88932-6780-42a7-8138-4d6402de0b81", "observed-data--57a88932-72cc-46fd-b6ec-4cae02de0b81", "url--57a88932-72cc-46fd-b6ec-4cae02de0b81", "indicator--57a88ce8-5518-4f78-880b-4338950d210f", "indicator--57a88d46-5be8-43a8-a8f5-4214950d210f", "indicator--57a88d47-6e64-4001-8edd-42cf950d210f", "indicator--57a88d47-85a0-4b82-aa20-4c86950d210f", "indicator--57a88d47-4ed8-406d-9b7a-4a15950d210f", "indicator--57a88d47-781c-4701-b87b-4227950d210f", "indicator--57a88d47-8d90-4087-a16e-4007950d210f", "indicator--57a88de1-7928-481d-8410-492e950d210f", "indicator--57a88e05-98f4-47fc-8b65-4444950d210f", "indicator--57a88e85-d6e8-46eb-9415-4da0950d210f", "indicator--57a88ec8-3460-42bf-adf3-4cb8950d210f", "indicator--57a8914a-a938-4f12-a6d0-48e0950d210f", "indicator--57a8914a-dde8-4147-a826-4cea950d210f", "indicator--57a8915d-b784-457f-9ad3-45b7950d210f", "indicator--57a8919a-b2a4-4d94-be0d-4e42950d210f", "indicator--57a891ea-2728-4d10-bb9d-4a80950d210f", "indicator--57a89eb7-8f40-4ab7-a7a4-4fe6950d210f" ], "labels": [ "Threat-Report", "misp:tool=\"MISP-STIX-Converter\"", "type:OSINT" ], "object_marking_refs": [ "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88352-7acc-4ad7-be40-453d950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:04:18.000Z", "modified": "2016-08-08T13:04:18.000Z", "first_observed": "2016-08-08T13:04:18Z", "last_observed": "2016-08-08T13:04:18Z", "number_observed": 1, "object_refs": [ "url--57a88352-7acc-4ad7-be40-453d950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88352-7acc-4ad7-be40-453d950d210f", "value": "http://www.symantec.com/connect/blogs/strider-cyberespionage-group-turns-eye-sauron-targets" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a8837a-a450-4ced-b08e-4905950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:04:58.000Z", "modified": "2016-08-08T13:04:58.000Z", "labels": [ "misp:type=\"comment\"", "misp:category=\"External analysis\"" ], "x_misp_category": "External analysis", "x_misp_type": "comment", "x_misp_value": "A previously unknown group called Strider has been conducting cyberespionage-style attacks against selected targets in Russia, China, Sweden, and Belgium. The group uses an advanced piece of malware known as Remsec (Backdoor.Remsec) to conduct its attacks. Remsec is a stealthy tool that appears to be primarily designed for spying purposes. Its code contains a reference to Sauron, the all-seeing antagonist in Lord of the Rings.\r\n\r\nStrider\u00e2\u20ac\u2122s attacks have tentative links with a previously uncovered group, Flamer. The use of Lua modules, which we\u00e2\u20ac\u2122ll discuss later, is a technique that has previously been used by Flamer. One of Strider\u00e2\u20ac\u2122s targets had also previously been infected by Regin." }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a883b4-fabc-4936-8e65-41c8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:05:56.000Z", "modified": "2016-08-08T13:05:56.000Z", "labels": [ "misp:type=\"text\"", "misp:category=\"Antivirus detection\"" ], "x_misp_category": "Antivirus detection", "x_misp_type": "text", "x_misp_value": "Backdoor.Remsec" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a88419-1900-403e-845c-47da950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:07:37.000Z", "modified": "2016-08-08T13:07:37.000Z", "labels": [ "misp:type=\"target-location\"", "misp:category=\"Targeting data\"" ], "x_misp_category": "Targeting data", "x_misp_comment": "Only a small number of organizations in four countries are impacted by Strider", "x_misp_type": "target-location", "x_misp_value": "Belgium" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a8841a-455c-4b87-96a5-4325950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:07:38.000Z", "modified": "2016-08-08T13:07:38.000Z", "labels": [ "misp:type=\"target-location\"", "misp:category=\"Targeting data\"" ], "x_misp_category": "Targeting data", "x_misp_comment": "Only a small number of organizations in four countries are impacted by Strider", "x_misp_type": "target-location", "x_misp_value": "Sweden" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a8841a-a3cc-457b-9a54-4e8c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:07:38.000Z", "modified": "2016-08-08T13:07:38.000Z", "labels": [ "misp:type=\"target-location\"", "misp:category=\"Targeting data\"" ], "x_misp_category": "Targeting data", "x_misp_comment": "Only a small number of organizations in four countries are impacted by Strider", "x_misp_type": "target-location", "x_misp_value": "Russia" }, { "type": "x-misp-attribute", "spec_version": "2.1", "id": "x-misp-attribute--57a8841a-f964-41c4-81a5-43e4950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:07:38.000Z", "modified": "2016-08-08T13:07:38.000Z", "labels": [ "misp:type=\"target-location\"", "misp:category=\"Targeting data\"" ], "x_misp_category": "Targeting data", "x_misp_comment": "Only a small number of organizations in four countries are impacted by Strider", "x_misp_type": "target-location", "x_misp_value": "China" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88454-b0c4-432b-ae28-4558950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:08:36.000Z", "modified": "2016-08-08T13:08:36.000Z", "pattern": "[file:name = 'MSAOSSPC.DLL']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:08:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a885bc-1614-4e58-8e17-4457950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:14:36.000Z", "modified": "2016-08-08T13:14:36.000Z", "first_observed": "2016-08-08T13:14:36Z", "last_observed": "2016-08-08T13:14:36Z", "number_observed": 1, "object_refs": [ "url--57a885bc-1614-4e58-8e17-4457950d210f" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a885bc-1614-4e58-8e17-4457950d210f", "value": "http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a885fd-10f8-46fe-8f9d-44ca950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:15:41.000Z", "modified": "2016-08-08T13:15:41.000Z", "pattern": "[file:name = 'MSAOSSPC.DLL' AND file:hashes.MD5 = '2a8785bf45f4f03c10cd929bb0685c2d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:15:41Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"filename|md5\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88670-859c-439a-bd1d-4e63950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:17:36.000Z", "modified": "2016-08-08T13:17:36.000Z", "description": "The loaded executable blobs may be retrieved from the following path", "pattern": "[file:name = 'c:\\\\System Volume Information\\\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\\\RP0\\\\A0000002.dll']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:17:36Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a886ca-69c8-45d6-80ed-41fb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:19:06.000Z", "modified": "2016-08-08T13:19:06.000Z", "description": "is to receive executable modules from remote attackers and run them from memory on the local computer . (Network loader)", "pattern": "[file:hashes.MD5 = '90b4b5f0a475f3a028be2f71409e6d1a']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:19:06Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88713-13ec-49db-a8cf-4ccb950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:19.000Z", "modified": "2016-08-08T13:20:19.000Z", "description": "Host loader", "pattern": "[file:hashes.MD5 = '7261230a43a40bb29227a169c2c8e1be']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88713-03d0-4507-a60c-4d2f950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:19.000Z", "modified": "2016-08-08T13:20:19.000Z", "description": "Host loader", "pattern": "[file:hashes.MD5 = '48d0c8faaee08fc51346925090af89aa']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88726-e6ec-4913-926b-44f102de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:38.000Z", "modified": "2016-08-08T13:20:38.000Z", "description": "- Xchecked via VT: 2a8785bf45f4f03c10cd929bb0685c2d", "pattern": "[file:hashes.SHA256 = '6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:38Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88727-5970-4226-a94e-412602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:39.000Z", "modified": "2016-08-08T13:20:39.000Z", "description": "- Xchecked via VT: 2a8785bf45f4f03c10cd929bb0685c2d", "pattern": "[file:hashes.SHA1 = 'd18792a187d7567f3f31908c05a8b8a2647d365f']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:39Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload installation" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload installation\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88727-6cfc-4135-9911-471d02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:39.000Z", "modified": "2016-08-08T13:20:39.000Z", "first_observed": "2016-08-08T13:20:39Z", "last_observed": "2016-08-08T13:20:39Z", "number_observed": 1, "object_refs": [ "url--57a88727-6cfc-4135-9911-471d02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88727-6cfc-4135-9911-471d02de0b81", "value": "https://www.virustotal.com/file/6c8c93069831a1b60279d2b316fd36bffa0d4c407068dbef81b8e2fe8fd8e8cd/analysis/1470296379/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88728-93e0-497c-b71b-438402de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:40.000Z", "modified": "2016-08-08T13:20:40.000Z", "description": "Host loader - Xchecked via VT: 7261230a43a40bb29227a169c2c8e1be", "pattern": "[file:hashes.SHA256 = 'd737644d612e5051f66fb97a34ec592b3508be06e33f743a2fdb31cdf6bd2718']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88728-fd5c-4297-be69-470b02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:40.000Z", "modified": "2016-08-08T13:20:40.000Z", "description": "Host loader - Xchecked via VT: 7261230a43a40bb29227a169c2c8e1be", "pattern": "[file:hashes.SHA1 = '1bb7614bb7c3042796c8dc7befdd8042197f222d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:20:40Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88729-dd00-4f3f-8a83-4f6602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:20:41.000Z", "modified": "2016-08-08T13:20:41.000Z", "first_observed": "2016-08-08T13:20:41Z", "last_observed": "2016-08-08T13:20:41Z", "number_observed": 1, "object_refs": [ "url--57a88729-dd00-4f3f-8a83-4f6602de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88729-dd00-4f3f-8a83-4f6602de0b81", "value": "https://www.virustotal.com/file/d737644d612e5051f66fb97a34ec592b3508be06e33f743a2fdb31cdf6bd2718/analysis/1470649331/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88830-f1b4-4a1e-b841-4c5c950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:25:04.000Z", "modified": "2016-08-08T13:25:04.000Z", "description": "The keylogger logs data to the following location", "pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\\\\\temp\\\\\\\\bka*.da']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:25:04Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8886b-ba78-49a2-aadb-48cd950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:26:03.000Z", "modified": "2016-08-08T13:26:03.000Z", "description": "The keylogger logs data to the following location", "pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\\\\\temp\\\\\\\\bka*.dat']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:26:03Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a888a3-e1b0-4996-a918-4eca950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:26:59.000Z", "modified": "2016-08-08T13:26:59.000Z", "description": "The keylogger logs data to the following location", "pattern": "[file:name = 'C:\\\\\\\\System Volume Information\\\\\\\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\\\\\\\RP0\\\\\\\\change.log']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:26:59Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a888f0-ad44-4490-9f2f-4486950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:16.000Z", "modified": "2016-08-08T13:28:16.000Z", "description": "The keylogger logs data to the following location", "pattern": "[file:name = 'C:\\\\\\\\System Volume Information\\\\\\\\_restore{ED650925-A32C-4E9C-8A73-8E6F0509309A}\\\\\\\\RP1\\\\\\\\A*']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:16Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88918-641c-44a7-8ab9-453b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:56.000Z", "modified": "2016-08-08T13:28:56.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '0a0948d871ef5a3006c0ab2997ad330e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88918-cf7c-4e27-8853-4557950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:56.000Z", "modified": "2016-08-08T13:28:56.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '113050c3e3140bf631d186d78d4b1dc0']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88918-57d0-44b7-88a5-4a1b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:56.000Z", "modified": "2016-08-08T13:28:56.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '1d9d7d05ab7c68bdc257afb1c086fb88']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88918-6ac0-43b5-a57a-485e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:56.000Z", "modified": "2016-08-08T13:28:56.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '1f316e14e773ca0f468d0d160b5d0307']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:56Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88919-2298-4047-9466-4583950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:57.000Z", "modified": "2016-08-08T13:28:57.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '7b8a3bf6fd266593db96eddaa3fae6f9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:57Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88919-8ba4-40f1-99fa-4e7b950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:57.000Z", "modified": "2016-08-08T13:28:57.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = 'cf6c049bd7cd9e04cc365b73f3f6098e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:57Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88919-a6bc-4fea-910b-4aad950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:28:57.000Z", "modified": "2016-08-08T13:28:57.000Z", "description": "Network listeners", "pattern": "[file:hashes.MD5 = '7c3eecfb5174ca5cb1e03b8bf4b06f19']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:28:57Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"md5\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892e-d428-466b-b840-469c02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:18.000Z", "modified": "2016-08-08T13:29:18.000Z", "description": "Network listeners - Xchecked via VT: 7c3eecfb5174ca5cb1e03b8bf4b06f19", "pattern": "[file:hashes.SHA256 = '02a9b52c88199e5611871d634b6188c35a174944f75f6d8a2110b5b1c5e60a48']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:18Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892e-7f90-4990-85ac-49ae02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:18.000Z", "modified": "2016-08-08T13:29:18.000Z", "description": "Network listeners - Xchecked via VT: 7c3eecfb5174ca5cb1e03b8bf4b06f19", "pattern": "[file:hashes.SHA1 = 'b5fbba3182ef25b20fecfc537effeeede977a2fc']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:18Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a8892e-ef88-415d-80e0-498e02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:18.000Z", "modified": "2016-08-08T13:29:18.000Z", "first_observed": "2016-08-08T13:29:18Z", "last_observed": "2016-08-08T13:29:18Z", "number_observed": 1, "object_refs": [ "url--57a8892e-ef88-415d-80e0-498e02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a8892e-ef88-415d-80e0-498e02de0b81", "value": "https://www.virustotal.com/file/02a9b52c88199e5611871d634b6188c35a174944f75f6d8a2110b5b1c5e60a48/analysis/1470649329/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892f-cc04-4152-9128-4b7302de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:19.000Z", "modified": "2016-08-08T13:29:19.000Z", "description": "Network listeners - Xchecked via VT: cf6c049bd7cd9e04cc365b73f3f6098e", "pattern": "[file:hashes.SHA256 = '6b06522f803437d51c15832dbd6b91d8d8b244440b4d2f09bd952f335351b06d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892f-711c-446a-80a1-497e02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:19.000Z", "modified": "2016-08-08T13:29:19.000Z", "description": "Network listeners - Xchecked via VT: cf6c049bd7cd9e04cc365b73f3f6098e", "pattern": "[file:hashes.SHA1 = '90bead07f7c6c92c6ca2b34406c5ea516307ee4e']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a8892f-24c4-458c-bc44-45d802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:19.000Z", "modified": "2016-08-08T13:29:19.000Z", "first_observed": "2016-08-08T13:29:19Z", "last_observed": "2016-08-08T13:29:19Z", "number_observed": 1, "object_refs": [ "url--57a8892f-24c4-458c-bc44-45d802de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a8892f-24c4-458c-bc44-45d802de0b81", "value": "https://www.virustotal.com/file/6b06522f803437d51c15832dbd6b91d8d8b244440b4d2f09bd952f335351b06d/analysis/1470649331/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892f-c620-4e9f-915d-4c2b02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:19.000Z", "modified": "2016-08-08T13:29:19.000Z", "description": "Network listeners - Xchecked via VT: 7b8a3bf6fd266593db96eddaa3fae6f9", "pattern": "[file:hashes.SHA256 = '3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8892f-3c50-45a8-a921-4c8102de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:19.000Z", "modified": "2016-08-08T13:29:19.000Z", "description": "Network listeners - Xchecked via VT: 7b8a3bf6fd266593db96eddaa3fae6f9", "pattern": "[file:hashes.SHA1 = 'd18df80316160535aa798303b6f02b6ae8e04388']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:19Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88930-d4d4-49f5-8125-433502de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:20.000Z", "modified": "2016-08-08T13:29:20.000Z", "first_observed": "2016-08-08T13:29:20Z", "last_observed": "2016-08-08T13:29:20Z", "number_observed": 1, "object_refs": [ "url--57a88930-d4d4-49f5-8125-433502de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88930-d4d4-49f5-8125-433502de0b81", "value": "https://www.virustotal.com/file/3782b63d7f6f688a5ccb1b72be89a6a98bb722218c9f22402709af97a41973c8/analysis/1470653929/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88930-0918-4973-8a8e-454b02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:20.000Z", "modified": "2016-08-08T13:29:20.000Z", "description": "Network listeners - Xchecked via VT: 1f316e14e773ca0f468d0d160b5d0307", "pattern": "[file:hashes.SHA256 = '9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:20Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88930-cfa4-41f9-96bd-40e802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:20.000Z", "modified": "2016-08-08T13:29:20.000Z", "description": "Network listeners - Xchecked via VT: 1f316e14e773ca0f468d0d160b5d0307", "pattern": "[file:hashes.SHA1 = '4bf1fd9c721d13b74a1aa18d4bf1981558697fc7']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:20Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88930-0520-41f5-adf5-4ba602de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:20.000Z", "modified": "2016-08-08T13:29:20.000Z", "first_observed": "2016-08-08T13:29:20Z", "last_observed": "2016-08-08T13:29:20Z", "number_observed": 1, "object_refs": [ "url--57a88930-0520-41f5-adf5-4ba602de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88930-0520-41f5-adf5-4ba602de0b81", "value": "https://www.virustotal.com/file/9572624b6026311a0e122835bcd7200eca396802000d0777dba118afaaf9f2a9/analysis/1470653936/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88931-8c58-4ed9-9396-471902de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:21.000Z", "modified": "2016-08-08T13:29:21.000Z", "description": "Network listeners - Xchecked via VT: 1d9d7d05ab7c68bdc257afb1c086fb88", "pattern": "[file:hashes.SHA256 = 'c8f95bf8a76ff124cc1d7a8439beff360d0eb9c0972d42a8684c3bd4e91c6600']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88931-ad84-4ded-b269-4cc802de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:21.000Z", "modified": "2016-08-08T13:29:21.000Z", "description": "Network listeners - Xchecked via VT: 1d9d7d05ab7c68bdc257afb1c086fb88", "pattern": "[file:hashes.SHA1 = '63b579b9671b45478b42a5f96110c9d4234f7c82']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88931-d260-41f7-97d5-462202de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:21.000Z", "modified": "2016-08-08T13:29:21.000Z", "first_observed": "2016-08-08T13:29:21Z", "last_observed": "2016-08-08T13:29:21Z", "number_observed": 1, "object_refs": [ "url--57a88931-d260-41f7-97d5-462202de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88931-d260-41f7-97d5-462202de0b81", "value": "https://www.virustotal.com/file/c8f95bf8a76ff124cc1d7a8439beff360d0eb9c0972d42a8684c3bd4e91c6600/analysis/1470653946/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88931-c5f0-4ac8-8a8d-4dda02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:21.000Z", "modified": "2016-08-08T13:29:21.000Z", "description": "Network listeners - Xchecked via VT: 113050c3e3140bf631d186d78d4b1dc0", "pattern": "[file:hashes.SHA256 = 'bde264ceb211089f6a9c8cfbaf3974bf3d7bf4843d22186684464152c432f8a5']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88931-6a54-4009-af93-4c9002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:21.000Z", "modified": "2016-08-08T13:29:21.000Z", "description": "Network listeners - Xchecked via VT: 113050c3e3140bf631d186d78d4b1dc0", "pattern": "[file:hashes.SHA1 = '3ae2cafb053009c16dbec057184c6250b450b914']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88932-3ecc-484f-ab05-472002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:22.000Z", "modified": "2016-08-08T13:29:22.000Z", "first_observed": "2016-08-08T13:29:22Z", "last_observed": "2016-08-08T13:29:22Z", "number_observed": 1, "object_refs": [ "url--57a88932-3ecc-484f-ab05-472002de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88932-3ecc-484f-ab05-472002de0b81", "value": "https://www.virustotal.com/file/bde264ceb211089f6a9c8cfbaf3974bf3d7bf4843d22186684464152c432f8a5/analysis/1470173246/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88932-98c0-474a-aaae-442002de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:22.000Z", "modified": "2016-08-08T13:29:22.000Z", "description": "Network listeners - Xchecked via VT: 0a0948d871ef5a3006c0ab2997ad330e", "pattern": "[file:hashes.SHA256 = 'ab8181ae5cc205f1d3cae00d8b34011e47b735a553bd5a4f079f03052b74a06d']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88932-6780-42a7-8138-4d6402de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:22.000Z", "modified": "2016-08-08T13:29:22.000Z", "description": "Network listeners - Xchecked via VT: 0a0948d871ef5a3006c0ab2997ad330e", "pattern": "[file:hashes.SHA1 = 'ee9eccad334b3bd8874b7259555a93ccb23f7e59']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:29:22Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha1\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "observed-data", "spec_version": "2.1", "id": "observed-data--57a88932-72cc-46fd-b6ec-4cae02de0b81", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:29:22.000Z", "modified": "2016-08-08T13:29:22.000Z", "first_observed": "2016-08-08T13:29:22Z", "last_observed": "2016-08-08T13:29:22Z", "number_observed": 1, "object_refs": [ "url--57a88932-72cc-46fd-b6ec-4cae02de0b81" ], "labels": [ "misp:type=\"link\"", "misp:category=\"External analysis\"" ] }, { "type": "url", "spec_version": "2.1", "id": "url--57a88932-72cc-46fd-b6ec-4cae02de0b81", "value": "https://www.virustotal.com/file/ab8181ae5cc205f1d3cae00d8b34011e47b735a553bd5a4f079f03052b74a06d/analysis/1470649324/" }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88ce8-5518-4f78-880b-4338950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:45:12.000Z", "modified": "2016-08-08T13:45:12.000Z", "description": "Backdoor. Remsec", "pattern": "[file:hashes.SHA256 = '6189b94c9f3982ce15015d68f280f5d7a87074b829edb87825cadab6ec1c7ec2']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:45:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Payload delivery" } ], "labels": [ "misp:type=\"sha256\"", "misp:category=\"Payload delivery\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d46-5be8-43a8-a8f5-4214950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:46.000Z", "modified": "2016-08-08T13:46:46.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://flowershop22.110mb.com/flowers.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:46Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d47-6e64-4001-8edd-42cf950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:47.000Z", "modified": "2016-08-08T13:46:47.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://flowershop22.110mb.com/shop.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d47-85a0-4b82-aa20-4c86950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:47.000Z", "modified": "2016-08-08T13:46:47.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://wildhorses.awardspace.info/hindex.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d47-4ed8-406d-9b7a-4a15950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:47.000Z", "modified": "2016-08-08T13:46:47.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://wildhorses.awardspace.info/horses.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d47-781c-4701-b87b-4227950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:47.000Z", "modified": "2016-08-08T13:46:47.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://www.myhomemusic.com/music.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88d47-8d90-4087-a16e-4007950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:46:47.000Z", "modified": "2016-08-08T13:46:47.000Z", "description": "Imported via the Freetext Import Tool", "pattern": "[url:value = 'http://www.myhomemusic.com/mymusic.php']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T13:46:47Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"url\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88de1-7928-481d-8410-492e950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:49:21.000Z", "modified": "2016-08-08T13:49:21.000Z", "pattern": "[rule remsec_encrypted_api\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$open_process =\r\n/*\r\n\"OpenProcess\\x00\" in encrypted form\r\n*/\r\n{ 91 9A 8F B0 9C 90 8D AF 8C 8C 9A FF }\r\ncondition:\r\nall of them\r\n}]", "pattern_type": "yara", "valid_from": "2016-08-08T13:49:21Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"yara\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88e05-98f4-47fc-8b65-4444950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:49:57.000Z", "modified": "2016-08-08T13:49:57.000Z", "pattern": "[rule remsec_packer_A\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n/*\r\n69 ?? AB 00 00 00\r\nimul\r\nr0, 0ABh\r\n81 C? CD 2B 00 00\r\nadd\r\nr0, 2BCDh\r\nF7 E?\r\nmul\r\nr0\r\nC1 E? 0D\r\nshr\r\nr1, 0Dh\r\n69 ?? 85 CF 00 00\r\nimul\r\nr1, 0CF85h\r\n2B\r\nsub\r\nr0, r1\r\n*/\r\n{\r\n69 ( C? | D? | E? | F? ) AB 00 00 00\r\n( 81 | 41 81 ) C? CD 2B 00 00\r\n( F7 | 41 F7 ) E?\r\n( C1 | 41 C1 ) E? 0D\r\n( 69 | 45 69 ) ( C? | D? | E? | F? ) 85 CF 00 00\r\n( 29 | 41 29 | 44 29 | 45 29 | 2B | 41 2B | 44 2B | 45 2B )\r\n}\r\ncondition:\r\nall of them\r\n}]", "pattern_type": "yara", "valid_from": "2016-08-08T13:49:57Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"yara\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88e85-d6e8-46eb-9415-4da0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:52:05.000Z", "modified": "2016-08-08T13:52:05.000Z", "pattern": "[rule remsec_packer_B\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n{\r\n48 8B 05 ?? ?? ?? ??\r\n48 89 44 24 ??\r\n48 8B 05 ?? ?? ?? ??\r\n48 8D 4C 24 ??\r\n48 89 44 24 ??\r\n48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )\r\n( 44 88 6? 24 ?? | C6 44 24 ?? 00 )\r\n48 89 44 24 ??\r\n48 8D ( 45 ?? | 84 24 ?? ?? 00 00 )\r\nC7 44 24 ?? 0? 00 00 00\r\n2B ?8\r\n48 89 ?C 24 ??\r\n44 89 6? 24 ??\r\n83 C? 08\r\n89 ?C 24 ??\r\n( FF | 41 FF ) D?\r\n( 05 | 8D 88 ) 00 00 00 3A\r\n}\r\ncondition:\r\nall of them\r\n}]", "pattern_type": "yara", "valid_from": "2016-08-08T13:52:05Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"yara\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a88ec8-3460-42bf-adf3-4cb8950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T13:53:12.000Z", "modified": "2016-08-08T13:53:12.000Z", "pattern": "[rule remsec_executable_blob_32\r\n{\r\nmeta:\r\ncopyright = \"Symantec\"\r\nstrings:\r\n$code =\r\n{\r\n31 06\r\n83 C6 04\r\nD1 E8\r\n73 05\r\n35 01 00 00 D0\r\nE2 F0\r\n}\r\ncondition:\r\nall of them\r\n}]", "pattern_type": "yara", "valid_from": "2016-08-08T13:53:12Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"yara\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8914a-a938-4f12-a6d0-48e0950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T14:03:54.000Z", "modified": "2016-08-08T14:03:54.000Z", "pattern": "[domain-name:value = 'flowershop22.110mb.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T14:03:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8914a-dde8-4147-a826-4cea950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T14:03:54.000Z", "modified": "2016-08-08T14:03:54.000Z", "pattern": "[domain-name:value = 'wildhorses.awardspace.info']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T14:03:54Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"hostname\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8915d-b784-457f-9ad3-45b7950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T14:04:13.000Z", "modified": "2016-08-08T14:04:13.000Z", "pattern": "[domain-name:value = 'myhomemusic.com']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T14:04:13Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Network activity" } ], "labels": [ "misp:type=\"domain\"", "misp:category=\"Network activity\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a8919a-b2a4-4d94-be0d-4e42950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T14:05:14.000Z", "modified": "2016-08-08T14:05:14.000Z", "description": "Configuration data for host loader (version with MD5: 7261230a43a40bb29227a169c2c8e1be)", "pattern": "[file:name = 'c:\\\\\\\\System Volume Information\\\\\\\\{aa112c99-f343-4107-8ba1-22951714a641}']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T14:05:14Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a891ea-2728-4d10-bb9d-4a80950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-08T14:06:34.000Z", "modified": "2016-08-08T14:06:34.000Z", "description": "Configuration data for host loader (version with MD5: 7261230a43a40bb29227a169c2c8e1be)", "pattern": "[file:name = 'c:\\\\\\\\System Volume Information\\\\\\\\{951841cb-d1a4-4d7c-b44e-2c3d25996e37}']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-08T14:06:34Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"filename\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "indicator", "spec_version": "2.1", "id": "indicator--57a89eb7-8f40-4ab7-a7a4-4fe6950d210f", "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f", "created": "2016-08-09T13:57:10.000Z", "modified": "2016-08-09T13:57:10.000Z", "pattern": "[mutex:name = 'Global\\\\\\\\{b3898039-f3d8-4965-b618-a8a0d031cc5a}']", "pattern_type": "stix", "pattern_version": "2.1", "valid_from": "2016-08-09T13:57:10Z", "kill_chain_phases": [ { "kill_chain_name": "misp-category", "phase_name": "Artifacts dropped" } ], "labels": [ "misp:type=\"mutex\"", "misp:category=\"Artifacts dropped\"", "misp:to_ids=\"True\"" ] }, { "type": "marking-definition", "spec_version": "2.1", "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9", "created": "2017-01-20T00:00:00.000Z", "definition_type": "tlp", "name": "TLP:WHITE", "definition": { "tlp": "white" } } ] }