21385 lines
No EOL
899 KiB
JSON
21385 lines
No EOL
899 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--572754de-6fb8-4e96-887f-45ec950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:51:44.000Z",
|
|
"modified": "2016-05-02T13:51:44.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--572754de-6fb8-4e96-887f-45ec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:51:44.000Z",
|
|
"modified": "2016-05-02T13:51:44.000Z",
|
|
"name": "OSINT - Prince of Persia: Infy Malware Active In Decade of Targeted Attacks",
|
|
"published": "2016-05-02T13:55:13Z",
|
|
"object_refs": [
|
|
"indicator--57275555-4bec-4485-abc7-4749950d210f",
|
|
"indicator--57275556-95e4-4af0-93ca-4017950d210f",
|
|
"indicator--57275556-e988-4f36-a311-4611950d210f",
|
|
"indicator--57275557-dbe0-43e0-8915-4f39950d210f",
|
|
"indicator--57275557-455c-4d8b-acb1-4bf1950d210f",
|
|
"indicator--57275558-a790-4b03-b467-44e3950d210f",
|
|
"indicator--57275558-896c-4e1f-b489-4005950d210f",
|
|
"indicator--57275558-aa2c-4efd-9818-453f950d210f",
|
|
"indicator--57275559-6c48-4ad5-9879-4dc5950d210f",
|
|
"indicator--57275559-15d0-47fd-8610-4547950d210f",
|
|
"indicator--5727555a-bb00-4810-a71c-4680950d210f",
|
|
"indicator--5727555a-c4a4-4972-8371-40ea950d210f",
|
|
"indicator--5727555a-4214-4e00-b2f3-495d950d210f",
|
|
"indicator--5727555b-7120-4763-81e2-4724950d210f",
|
|
"indicator--5727555b-deb4-4511-adf6-4eec950d210f",
|
|
"indicator--5727555c-f5a0-405d-a4af-4320950d210f",
|
|
"indicator--5727555c-3220-47c8-879a-43a6950d210f",
|
|
"indicator--5727555c-712c-4ccf-987a-49f2950d210f",
|
|
"indicator--5727555d-8d5c-4fbe-8bad-4f14950d210f",
|
|
"indicator--5727555d-6acc-42d3-9697-4105950d210f",
|
|
"indicator--5727555e-95b4-49aa-96c9-4e73950d210f",
|
|
"indicator--5727555e-d8d8-4147-81b1-4f70950d210f",
|
|
"indicator--5727555e-5218-41a6-8ceb-4fdb950d210f",
|
|
"indicator--5727555f-1c58-4114-bf95-4404950d210f",
|
|
"indicator--5727555f-6fb4-4661-9ec2-47b1950d210f",
|
|
"indicator--57275560-2118-4f45-b2ff-479e950d210f",
|
|
"indicator--57275560-1b30-4572-b7c7-498e950d210f",
|
|
"indicator--57275560-bbc0-46bc-acf8-4105950d210f",
|
|
"indicator--57275561-9114-4583-a777-4258950d210f",
|
|
"indicator--57275561-787c-421f-b2d2-4763950d210f",
|
|
"indicator--57275562-f134-45a0-911c-4974950d210f",
|
|
"indicator--57275562-a410-42e4-822e-4061950d210f",
|
|
"indicator--57275562-ca8c-45ce-8b69-431a950d210f",
|
|
"indicator--57275563-53e4-48c7-91e8-48b2950d210f",
|
|
"indicator--57275563-7320-4228-981c-4bf8950d210f",
|
|
"indicator--57275564-dff0-47d2-b610-46e9950d210f",
|
|
"indicator--57275564-1244-41ef-bfa3-4d13950d210f",
|
|
"indicator--57275564-5ecc-4773-ae8a-4a52950d210f",
|
|
"indicator--57275565-b770-49df-8e66-4b6b950d210f",
|
|
"indicator--57275565-3bc8-4808-b9ec-4744950d210f",
|
|
"indicator--57275566-c51c-43b7-ae13-4064950d210f",
|
|
"indicator--57275566-63c0-42b4-b72a-47f6950d210f",
|
|
"indicator--57275566-ecb4-47d0-90b9-42d7950d210f",
|
|
"indicator--57275567-0d64-4665-81a8-446d950d210f",
|
|
"indicator--57275567-1094-4817-9771-4f2a950d210f",
|
|
"indicator--57275568-c1f8-4fca-8712-45f9950d210f",
|
|
"indicator--57275568-f460-4f8e-acaa-4e5a950d210f",
|
|
"indicator--57275568-a544-4e26-92fc-42d8950d210f",
|
|
"indicator--57275569-037c-4640-91f8-44bb950d210f",
|
|
"indicator--5727566e-1b6c-4151-86c7-4906950d210f",
|
|
"indicator--5727566e-7ffc-4d64-b157-4344950d210f",
|
|
"indicator--5727566e-3e94-466a-8ef6-4679950d210f",
|
|
"indicator--5727566f-b528-47d8-ab9c-4fd9950d210f",
|
|
"indicator--5727566f-5d74-4d32-8401-4367950d210f",
|
|
"indicator--5727566f-75cc-42b0-88ba-4bd3950d210f",
|
|
"indicator--57275670-f324-4e76-9e19-40ec950d210f",
|
|
"indicator--57275670-b254-4469-9c18-4715950d210f",
|
|
"indicator--57275670-e408-4e60-a09c-4c37950d210f",
|
|
"indicator--57275671-1e80-43b5-92e1-4756950d210f",
|
|
"indicator--57275671-974c-436d-a611-47aa950d210f",
|
|
"indicator--57275672-7198-4ecd-bbaa-43d0950d210f",
|
|
"indicator--57275672-6248-47d9-acfb-4288950d210f",
|
|
"indicator--57275672-003c-468b-a7d9-49f0950d210f",
|
|
"indicator--57275673-cdb8-4301-8355-4688950d210f",
|
|
"indicator--57275673-60b0-47fc-87d3-4fe3950d210f",
|
|
"indicator--57275674-247c-4a20-91fb-4faa950d210f",
|
|
"indicator--57275674-e0b8-4493-94b5-423d950d210f",
|
|
"indicator--57275674-ff24-40a8-8163-421a950d210f",
|
|
"indicator--57275675-d040-464f-a832-41da950d210f",
|
|
"indicator--57275675-11d4-4c49-a0a7-4506950d210f",
|
|
"indicator--57275676-b778-4ab2-adf0-4b90950d210f",
|
|
"indicator--57275676-d734-43b4-af36-4f3d950d210f",
|
|
"indicator--57275676-ce2c-46ff-a68b-48e8950d210f",
|
|
"indicator--57275677-6820-4bbb-80ce-41c5950d210f",
|
|
"indicator--57275677-0834-4995-b809-47f5950d210f",
|
|
"indicator--57275678-1d1c-4d35-b51d-422b950d210f",
|
|
"indicator--57275678-ad58-4bf7-8b03-4051950d210f",
|
|
"indicator--57275678-7528-4bcf-b7da-45f2950d210f",
|
|
"indicator--57275679-67dc-49ef-8018-459c950d210f",
|
|
"indicator--57275679-6d48-46d6-bb4d-4fd3950d210f",
|
|
"indicator--5727567a-ba64-4317-8031-4e0f950d210f",
|
|
"indicator--5727567a-b60c-4e21-8c45-43c3950d210f",
|
|
"indicator--5727567a-cb3c-4d8b-8bef-4874950d210f",
|
|
"indicator--5727567b-ad34-4ad1-80c8-49b2950d210f",
|
|
"indicator--5727567b-c86c-464c-8d2c-4cc4950d210f",
|
|
"indicator--5727567b-204c-442f-9538-46c7950d210f",
|
|
"indicator--5727567c-7b94-42e5-8a56-42cb950d210f",
|
|
"indicator--5727567c-ef04-46ca-a64b-41d2950d210f",
|
|
"indicator--5727567d-16b0-4d72-8926-4e16950d210f",
|
|
"indicator--5727567d-2324-410c-a592-4756950d210f",
|
|
"indicator--5727567d-c20c-4819-8ea9-4813950d210f",
|
|
"indicator--5727567e-2ed4-42ff-814f-48da950d210f",
|
|
"indicator--5727567e-6744-444e-956c-46af950d210f",
|
|
"indicator--5727567e-7584-42e4-919b-4caf950d210f",
|
|
"indicator--5727567f-3600-4500-bfb9-4695950d210f",
|
|
"indicator--5727567f-b230-45a4-9280-41ee950d210f",
|
|
"indicator--57275680-8edc-432a-b6d9-4919950d210f",
|
|
"indicator--57275680-7cf4-4d24-bc0f-4c76950d210f",
|
|
"indicator--57275680-fba4-484d-8067-44c8950d210f",
|
|
"indicator--57275681-6a5c-421e-80f3-46d2950d210f",
|
|
"indicator--57275681-443c-41f3-861c-4878950d210f",
|
|
"indicator--57275681-1710-48b2-8737-432c950d210f",
|
|
"indicator--57275682-b2f8-4536-87f5-40a8950d210f",
|
|
"indicator--57275682-2e74-4728-8688-4e8a950d210f",
|
|
"indicator--57275682-8d80-4e69-a5d5-4ed2950d210f",
|
|
"indicator--57275682-7394-4bf6-9eb2-4eb5950d210f",
|
|
"indicator--57275683-a21c-4dc2-8d55-4565950d210f",
|
|
"indicator--57275683-6764-43f5-a140-4383950d210f",
|
|
"indicator--57275684-b850-44d9-bcf9-4d84950d210f",
|
|
"indicator--57275684-3088-4a71-8efb-4786950d210f",
|
|
"indicator--57275684-8850-4b84-ba1e-46c2950d210f",
|
|
"indicator--57275685-3c30-4bc7-aef5-49ea950d210f",
|
|
"indicator--57275685-94ec-458a-a6f0-4b3f950d210f",
|
|
"indicator--57275685-7668-48c3-8f0e-4c52950d210f",
|
|
"indicator--57275685-1288-4f4c-80b5-45c4950d210f",
|
|
"indicator--57275686-0fc4-48e9-a1fb-4446950d210f",
|
|
"indicator--57275686-b62c-4e76-a528-4dc8950d210f",
|
|
"indicator--57275687-6904-43f8-8048-4c11950d210f",
|
|
"indicator--57275687-b77c-47af-92f6-4eb8950d210f",
|
|
"indicator--57275687-10c4-4254-bd3d-4a01950d210f",
|
|
"indicator--57275687-2654-4278-84ce-44f1950d210f",
|
|
"indicator--57275688-067c-4ebc-b72a-4388950d210f",
|
|
"indicator--57275688-cc30-479c-8fba-492c950d210f",
|
|
"indicator--57275688-b41c-4e15-a98b-4300950d210f",
|
|
"indicator--57275689-0ff8-4047-81e0-4442950d210f",
|
|
"indicator--57275689-99c0-4562-bbd9-44d6950d210f",
|
|
"indicator--5727568a-44cc-4f8f-9ebe-4dc3950d210f",
|
|
"indicator--5727568a-1034-4746-8e6c-4d06950d210f",
|
|
"indicator--5727568a-e608-4bfd-be77-4571950d210f",
|
|
"indicator--5727568b-239c-4b71-9d26-4394950d210f",
|
|
"indicator--5727568b-eaf8-4e01-9cb9-4351950d210f",
|
|
"indicator--5727568b-84ec-46d2-a027-43a6950d210f",
|
|
"indicator--5727568c-e30c-4c08-b36f-4d0d950d210f",
|
|
"indicator--5727568c-7398-497c-8bc8-4d57950d210f",
|
|
"indicator--5727568c-51ac-4a59-9ee7-4884950d210f",
|
|
"indicator--5727568d-1b08-4991-92e5-4f33950d210f",
|
|
"indicator--5727568d-a498-48cb-92fd-4ee2950d210f",
|
|
"indicator--5727568d-1f8c-4ecb-b501-4e08950d210f",
|
|
"indicator--5727568e-8290-4c9f-9875-4c21950d210f",
|
|
"indicator--5727568e-4994-4963-a567-4d47950d210f",
|
|
"indicator--5727568f-ef54-4fbc-b40c-4ad3950d210f",
|
|
"indicator--5727568f-d684-44a4-8646-4732950d210f",
|
|
"indicator--5727568f-7130-45ff-8570-40f5950d210f",
|
|
"indicator--57275690-f3ec-4dcb-95c5-4a09950d210f",
|
|
"indicator--57275690-f9a0-450e-8b2f-48f3950d210f",
|
|
"indicator--57275690-9a1c-4b78-944f-4c7d950d210f",
|
|
"indicator--57275691-91cc-4a15-93d4-4c9d950d210f",
|
|
"indicator--57275691-5ee4-4db1-be1c-46ba950d210f",
|
|
"indicator--57275692-9480-4804-8f57-4106950d210f",
|
|
"indicator--57275692-4d98-4b6d-a28b-4b55950d210f",
|
|
"indicator--57275692-ca10-482f-9228-42d0950d210f",
|
|
"indicator--57275693-a34c-4b6f-889c-400b950d210f",
|
|
"indicator--57275693-b6d0-4891-a109-4b14950d210f",
|
|
"indicator--57275693-06f0-489c-8fb8-4870950d210f",
|
|
"indicator--57275694-7490-4a4c-8f39-43c8950d210f",
|
|
"indicator--57275694-6048-4a4b-aa12-43f3950d210f",
|
|
"indicator--57275694-298c-4195-9f21-4def950d210f",
|
|
"indicator--57275695-e3ac-4cd8-9715-45d3950d210f",
|
|
"indicator--57275695-f168-493c-9f53-4d2f950d210f",
|
|
"indicator--57275695-b228-489e-8d55-4f4c950d210f",
|
|
"indicator--57275696-0af8-43a9-b681-4766950d210f",
|
|
"indicator--57275696-1ab4-43d4-ac71-4af3950d210f",
|
|
"indicator--57275697-e37c-4809-b707-471c950d210f",
|
|
"indicator--57275697-3ec8-43c1-8b14-42aa950d210f",
|
|
"indicator--57275697-f6bc-4a51-91bb-4f8c950d210f",
|
|
"indicator--57275698-71dc-4e34-a12d-4d5c950d210f",
|
|
"indicator--57275698-8ffc-4c3e-9615-4821950d210f",
|
|
"indicator--57275698-02e4-4cf8-b1ac-4bdb950d210f",
|
|
"indicator--57275699-9030-4070-9fdc-4c09950d210f",
|
|
"indicator--57275699-bcbc-42a8-a919-4af5950d210f",
|
|
"indicator--57275699-3c88-4a40-bbe1-4995950d210f",
|
|
"indicator--5727569a-65b4-47ad-aa57-456d950d210f",
|
|
"indicator--5727569a-1b58-4dc1-bd62-422d950d210f",
|
|
"indicator--5727569a-a9bc-43cc-b8e8-41bd950d210f",
|
|
"indicator--5727569b-5ee0-43f8-971f-4f42950d210f",
|
|
"indicator--5727569b-5648-4422-ab02-4a22950d210f",
|
|
"indicator--5727569b-8de8-4081-89bd-4e57950d210f",
|
|
"indicator--5727569c-cd70-4f44-b51a-4716950d210f",
|
|
"indicator--5727569c-b970-41ed-b858-4b13950d210f",
|
|
"indicator--5727569c-b350-4875-861c-4e77950d210f",
|
|
"indicator--5727569d-5008-486c-805b-4736950d210f",
|
|
"indicator--5727569d-9600-4216-9e5d-4215950d210f",
|
|
"indicator--5727569d-c7b8-4e6f-9689-4762950d210f",
|
|
"indicator--5727569e-4e84-4704-9d9a-4a85950d210f",
|
|
"indicator--5727569e-8f4c-4312-83e3-4425950d210f",
|
|
"indicator--5727569f-51b0-4fb4-b75a-47c3950d210f",
|
|
"indicator--5727569f-983c-4a6f-ae9f-4b14950d210f",
|
|
"indicator--5727569f-660c-4ada-86cd-4f1f950d210f",
|
|
"indicator--572756a0-25fc-4f74-a811-439b950d210f",
|
|
"indicator--572756a0-55bc-42e0-8d64-4ef2950d210f",
|
|
"indicator--572756a0-1254-4116-b27a-49bc950d210f",
|
|
"indicator--572756a1-364c-493c-9277-43d2950d210f",
|
|
"indicator--572756a1-d0ac-4aa6-a92c-4373950d210f",
|
|
"indicator--572756a1-2808-4d02-98c0-44a4950d210f",
|
|
"indicator--572756a2-4ca0-4cb3-9662-45c8950d210f",
|
|
"indicator--572756a2-6424-472e-afcf-413e950d210f",
|
|
"indicator--572756a3-8dc0-48c3-ad7d-4c1e950d210f",
|
|
"indicator--572756a3-9920-490a-aba6-4ce7950d210f",
|
|
"indicator--572756a3-395c-4bef-8534-476a950d210f",
|
|
"indicator--572756a4-ca98-41e0-932e-47fb950d210f",
|
|
"indicator--572756a4-db44-43d9-86f4-4caa950d210f",
|
|
"indicator--572756a4-3d30-4af2-9021-4ed4950d210f",
|
|
"indicator--572756a5-a62c-4da0-a0cd-489e950d210f",
|
|
"indicator--572756a5-8c10-4df3-b0de-4ad0950d210f",
|
|
"indicator--572756a5-cd94-44fd-83e5-4ce3950d210f",
|
|
"indicator--572756a6-4ba4-4873-b43f-4b8b950d210f",
|
|
"indicator--572756a6-8358-4581-b75b-4cf2950d210f",
|
|
"indicator--572756a6-5b84-443f-8e90-499c950d210f",
|
|
"indicator--572756a7-af74-49c9-a56e-40f9950d210f",
|
|
"indicator--572756a7-9c5c-4449-81fb-4a07950d210f",
|
|
"indicator--572756a7-0d70-4518-a8c2-4586950d210f",
|
|
"indicator--572756a8-fa04-4934-af63-4121950d210f",
|
|
"indicator--572756a8-dd94-4a93-afd2-4157950d210f",
|
|
"indicator--572756a8-118c-45a2-b590-4df9950d210f",
|
|
"indicator--572756a9-29a4-4077-8d07-4763950d210f",
|
|
"indicator--572756a9-f57c-4fcf-a271-4b4f950d210f",
|
|
"indicator--572756a9-e2f4-42da-bae1-4df7950d210f",
|
|
"indicator--572756aa-3fc0-4b86-82a0-4b55950d210f",
|
|
"indicator--572756aa-a650-4f5b-8ea5-4822950d210f",
|
|
"indicator--572756aa-9380-48c6-b47f-4f45950d210f",
|
|
"indicator--572756ab-79fc-4ae5-b2f9-4878950d210f",
|
|
"indicator--572756ab-9f38-4a9b-b1e7-4827950d210f",
|
|
"indicator--572756ab-658c-4faf-a555-4249950d210f",
|
|
"indicator--572756ac-c94c-4979-bcee-4db5950d210f",
|
|
"indicator--572756ac-d5e0-4f2e-82d1-429f950d210f",
|
|
"indicator--572756ac-f804-4279-9c94-4a73950d210f",
|
|
"indicator--572756ad-b398-4c30-a2f7-414d950d210f",
|
|
"indicator--572756ad-a8a0-42c0-822a-4c8a950d210f",
|
|
"indicator--572756ad-b3e0-4b3a-99ab-4eb7950d210f",
|
|
"indicator--572756ae-b134-488e-901a-41b3950d210f",
|
|
"indicator--572756ae-5794-410b-9aa8-4fb5950d210f",
|
|
"indicator--572756ae-7ca0-4632-bfa7-40a5950d210f",
|
|
"indicator--572756af-7f58-408d-83d7-445b950d210f",
|
|
"indicator--572756af-07b8-455d-b4c9-4407950d210f",
|
|
"indicator--572756af-f4f4-40ac-a4f9-44b4950d210f",
|
|
"indicator--572756b0-e5c4-4564-b92b-4921950d210f",
|
|
"indicator--572756b0-502c-4469-a52a-4777950d210f",
|
|
"indicator--572756b0-1bd0-453c-8fdb-472a950d210f",
|
|
"indicator--572756b1-8ebc-486e-a0bd-4837950d210f",
|
|
"indicator--572756b1-27c4-456f-975a-40c4950d210f",
|
|
"indicator--572756b1-cea8-4fdd-8542-4c66950d210f",
|
|
"indicator--572756b2-03ec-4747-affd-4a4f950d210f",
|
|
"indicator--572756b2-bf98-4d91-b5cb-4292950d210f",
|
|
"indicator--572756b2-0478-4e0c-8989-4a37950d210f",
|
|
"indicator--572756b3-4044-4cd7-9935-4474950d210f",
|
|
"indicator--572756b3-8d00-46f5-96bb-42fa950d210f",
|
|
"indicator--572756b3-13bc-46dd-887e-4564950d210f",
|
|
"indicator--572756b4-cd84-408d-9314-4055950d210f",
|
|
"indicator--572756b4-b0dc-47b9-a89a-4000950d210f",
|
|
"indicator--572756b5-a138-4a08-a592-4962950d210f",
|
|
"indicator--572756b5-916c-41bf-939d-4311950d210f",
|
|
"indicator--572756b5-e648-4d5d-a30b-4ef6950d210f",
|
|
"indicator--572756b6-a2d4-45df-9d73-4c13950d210f",
|
|
"indicator--572756b6-5b94-487e-8a20-4132950d210f",
|
|
"indicator--572756b6-0104-4c4e-8136-48ff950d210f",
|
|
"indicator--572756b7-a1e8-4eb6-9d23-4a92950d210f",
|
|
"indicator--572756b7-e6d4-4ab3-9482-4e85950d210f",
|
|
"indicator--572756b7-0438-4e57-a4d4-4a3a950d210f",
|
|
"indicator--572756b8-161c-4ced-b7d9-4dec950d210f",
|
|
"indicator--572756b8-b1c4-4200-8209-4e29950d210f",
|
|
"indicator--572756b8-329c-4b6b-aaa1-4e21950d210f",
|
|
"indicator--572756b9-02c8-43f8-8cef-494b950d210f",
|
|
"indicator--572756b9-f534-4997-8eea-4811950d210f",
|
|
"indicator--572756b9-f778-4ab9-b28b-495e950d210f",
|
|
"indicator--572756ba-e028-4b14-b33e-4a61950d210f",
|
|
"indicator--572756ba-bd04-43ff-8e1a-4546950d210f",
|
|
"indicator--572756ba-da68-4481-8101-4fc3950d210f",
|
|
"indicator--572756bb-115c-43bf-944a-4199950d210f",
|
|
"indicator--572756bb-c05c-4293-b7ca-4caa950d210f",
|
|
"indicator--572756bb-ae30-4ca8-85b9-4940950d210f",
|
|
"indicator--572756bc-e110-4510-a9df-46b0950d210f",
|
|
"indicator--572756bc-3830-420e-93f5-4888950d210f",
|
|
"indicator--572756bc-09b0-47ef-9331-4c51950d210f",
|
|
"indicator--572756bd-93c8-4047-91bd-4b1d950d210f",
|
|
"indicator--572756bd-9dac-4c91-81cf-45cf950d210f",
|
|
"indicator--572756bd-ed3c-4dbc-9570-4bb6950d210f",
|
|
"indicator--572756be-2c60-4519-9717-4675950d210f",
|
|
"indicator--572756be-3afc-4475-99b6-4358950d210f",
|
|
"indicator--572756be-b818-4264-8423-4bc6950d210f",
|
|
"indicator--572756bf-f040-40df-88fa-4019950d210f",
|
|
"indicator--572756bf-33ac-4bab-8967-44b6950d210f",
|
|
"indicator--572756bf-2880-4402-92c8-49df950d210f",
|
|
"indicator--572756c0-4ea0-441d-b603-4cc3950d210f",
|
|
"indicator--572756c0-4234-422a-824b-4e6c950d210f",
|
|
"indicator--572756c0-8d24-4096-b3ab-46c7950d210f",
|
|
"indicator--572756c1-e558-492e-a990-45a1950d210f",
|
|
"indicator--572756c1-623c-4ec1-98e6-4b91950d210f",
|
|
"observed-data--57275753-4898-44cf-bd84-4614950d210f",
|
|
"url--57275753-4898-44cf-bd84-4614950d210f",
|
|
"indicator--57275893-5090-45c6-8268-457b02de0b81",
|
|
"observed-data--57275894-8bf0-481a-9736-4d9002de0b81",
|
|
"url--57275894-8bf0-481a-9736-4d9002de0b81",
|
|
"indicator--57275894-2298-4600-8967-4d8002de0b81",
|
|
"indicator--57275894-85fc-43ec-abc2-4aa902de0b81",
|
|
"observed-data--57275895-2a78-44bc-8928-47b802de0b81",
|
|
"url--57275895-2a78-44bc-8928-47b802de0b81",
|
|
"indicator--57275895-2a10-4f3f-b674-41f902de0b81",
|
|
"observed-data--57275896-4594-47d5-9831-406802de0b81",
|
|
"url--57275896-4594-47d5-9831-406802de0b81",
|
|
"indicator--57275896-3b6c-48cb-b682-40d802de0b81",
|
|
"observed-data--57275896-a6d8-4490-b9f2-44bd02de0b81",
|
|
"url--57275896-a6d8-4490-b9f2-44bd02de0b81",
|
|
"indicator--57275897-dbb4-4484-b937-40b402de0b81",
|
|
"observed-data--57275897-f520-4c35-a006-434c02de0b81",
|
|
"url--57275897-f520-4c35-a006-434c02de0b81",
|
|
"indicator--57275898-c168-4e00-9ea8-490c02de0b81",
|
|
"observed-data--57275898-38cc-4de0-bf47-48e502de0b81",
|
|
"url--57275898-38cc-4de0-bf47-48e502de0b81",
|
|
"indicator--57275899-9a0c-42aa-af9c-4dd802de0b81",
|
|
"observed-data--57275899-dbc4-46a4-ab7d-420302de0b81",
|
|
"url--57275899-dbc4-46a4-ab7d-420302de0b81",
|
|
"indicator--57275899-4464-48bf-93ea-413c02de0b81",
|
|
"observed-data--5727589a-d628-4c8f-8261-407002de0b81",
|
|
"url--5727589a-d628-4c8f-8261-407002de0b81",
|
|
"indicator--5727589a-e79c-45ad-802f-45f602de0b81",
|
|
"observed-data--5727589b-62b8-46ea-a78e-477102de0b81",
|
|
"url--5727589b-62b8-46ea-a78e-477102de0b81",
|
|
"indicator--5727589b-94f4-4cd8-a012-4a4002de0b81",
|
|
"indicator--5727589b-c220-4b20-adc2-440b02de0b81",
|
|
"observed-data--5727589c-feb0-441b-8e31-484a02de0b81",
|
|
"url--5727589c-feb0-441b-8e31-484a02de0b81",
|
|
"indicator--5727589c-c3c4-42d9-88f9-415c02de0b81",
|
|
"observed-data--5727589c-0e58-4fa7-8d05-477002de0b81",
|
|
"url--5727589c-0e58-4fa7-8d05-477002de0b81",
|
|
"indicator--5727589d-4c50-446e-bc99-454302de0b81",
|
|
"observed-data--5727589d-8a04-41e1-af3d-4d9b02de0b81",
|
|
"url--5727589d-8a04-41e1-af3d-4d9b02de0b81",
|
|
"indicator--5727589d-c97c-481e-8991-411b02de0b81",
|
|
"observed-data--5727589e-30e4-4ce5-9684-4c0002de0b81",
|
|
"url--5727589e-30e4-4ce5-9684-4c0002de0b81",
|
|
"indicator--5727589e-b080-4625-b02d-4a6402de0b81",
|
|
"observed-data--5727589e-bba4-4f46-aa77-45cb02de0b81",
|
|
"url--5727589e-bba4-4f46-aa77-45cb02de0b81",
|
|
"indicator--5727589f-fd3c-4edd-9484-47b602de0b81",
|
|
"observed-data--5727589f-e094-453a-a8c3-490c02de0b81",
|
|
"url--5727589f-e094-453a-a8c3-490c02de0b81",
|
|
"indicator--5727589f-4098-4d06-b3cd-469602de0b81",
|
|
"indicator--572758a0-c568-4c6a-809b-453902de0b81",
|
|
"observed-data--572758a0-d51c-45d7-9e3e-448802de0b81",
|
|
"url--572758a0-d51c-45d7-9e3e-448802de0b81",
|
|
"indicator--572758a0-f88c-46e9-899f-4d8102de0b81",
|
|
"observed-data--572758a1-e35c-43c9-b4c3-470702de0b81",
|
|
"url--572758a1-e35c-43c9-b4c3-470702de0b81",
|
|
"indicator--572758a1-fdd8-45a9-a6b6-4d0202de0b81",
|
|
"observed-data--572758a1-19e0-49b4-af0d-4a3202de0b81",
|
|
"url--572758a1-19e0-49b4-af0d-4a3202de0b81",
|
|
"indicator--572758a2-2168-422a-a85a-431c02de0b81",
|
|
"observed-data--572758a2-e594-4a2d-b68f-42a402de0b81",
|
|
"url--572758a2-e594-4a2d-b68f-42a402de0b81",
|
|
"indicator--572758a2-64a8-435e-8699-424202de0b81",
|
|
"observed-data--572758a3-a334-4043-90ef-40a402de0b81",
|
|
"url--572758a3-a334-4043-90ef-40a402de0b81",
|
|
"indicator--572758a3-578c-4dc6-ab3b-4dd502de0b81",
|
|
"observed-data--572758a3-626c-430e-96e3-4af502de0b81",
|
|
"url--572758a3-626c-430e-96e3-4af502de0b81",
|
|
"indicator--572758a4-9e28-4b58-833b-47d702de0b81",
|
|
"observed-data--572758a4-e020-428c-a558-4cb702de0b81",
|
|
"url--572758a4-e020-428c-a558-4cb702de0b81",
|
|
"indicator--572758a4-23dc-483e-a541-4eec02de0b81",
|
|
"observed-data--572758a5-9300-4af8-95f9-4c2102de0b81",
|
|
"url--572758a5-9300-4af8-95f9-4c2102de0b81",
|
|
"indicator--572758a5-53d8-4ed8-8215-45a302de0b81",
|
|
"observed-data--572758a6-b4d4-4b93-963d-47d502de0b81",
|
|
"url--572758a6-b4d4-4b93-963d-47d502de0b81",
|
|
"indicator--572758a6-8788-417e-9885-459102de0b81",
|
|
"observed-data--572758a7-d6f4-4ebc-a956-4ced02de0b81",
|
|
"url--572758a7-d6f4-4ebc-a956-4ced02de0b81",
|
|
"indicator--572758a7-d1d0-4b12-a0df-4f6402de0b81",
|
|
"observed-data--572758a7-47c8-42d6-acf9-4f8602de0b81",
|
|
"url--572758a7-47c8-42d6-acf9-4f8602de0b81",
|
|
"indicator--572758a8-21a0-4ca4-bc8e-47ad02de0b81",
|
|
"observed-data--572758a8-acc0-40fb-9f6e-4c9602de0b81",
|
|
"url--572758a8-acc0-40fb-9f6e-4c9602de0b81",
|
|
"indicator--572758a9-d820-481c-a488-429b02de0b81",
|
|
"indicator--572758a9-08f4-453e-a53a-42d402de0b81",
|
|
"observed-data--572758a9-dd84-4221-8c40-42f302de0b81",
|
|
"url--572758a9-dd84-4221-8c40-42f302de0b81",
|
|
"indicator--572758aa-5590-4700-8447-427202de0b81",
|
|
"observed-data--572758aa-e4a4-4dae-af90-482c02de0b81",
|
|
"url--572758aa-e4a4-4dae-af90-482c02de0b81",
|
|
"indicator--572758ab-7918-4ab8-b611-4a6302de0b81",
|
|
"indicator--572758ab-12c0-45d5-9e5c-484802de0b81",
|
|
"observed-data--572758ab-9e58-4522-a31d-442502de0b81",
|
|
"url--572758ab-9e58-4522-a31d-442502de0b81",
|
|
"indicator--572758ac-729c-4604-9ab2-44a002de0b81",
|
|
"observed-data--572758ac-b200-4456-9b9f-413b02de0b81",
|
|
"url--572758ac-b200-4456-9b9f-413b02de0b81",
|
|
"indicator--572758ad-3030-4aea-8de3-4d8b02de0b81",
|
|
"observed-data--572758ad-1604-461f-80fa-48f802de0b81",
|
|
"url--572758ad-1604-461f-80fa-48f802de0b81",
|
|
"indicator--572758ae-7e54-4f08-8446-431702de0b81",
|
|
"observed-data--572758ae-4398-4543-bab6-4e0602de0b81",
|
|
"url--572758ae-4398-4543-bab6-4e0602de0b81",
|
|
"indicator--572758ae-44dc-4506-b72e-42a402de0b81",
|
|
"observed-data--572758af-c64c-443a-a239-4c9502de0b81",
|
|
"url--572758af-c64c-443a-a239-4c9502de0b81",
|
|
"indicator--572758af-4c4c-4952-ba89-452202de0b81",
|
|
"observed-data--572758b0-21a4-429d-aadf-495602de0b81",
|
|
"url--572758b0-21a4-429d-aadf-495602de0b81",
|
|
"indicator--572758b0-be60-4ebc-a46f-498002de0b81",
|
|
"observed-data--572758b1-cabc-4f6e-8a21-426a02de0b81",
|
|
"url--572758b1-cabc-4f6e-8a21-426a02de0b81",
|
|
"indicator--572758b1-75f4-41ec-86e3-4aa202de0b81",
|
|
"observed-data--572758b1-0948-478c-850e-47c602de0b81",
|
|
"url--572758b1-0948-478c-850e-47c602de0b81",
|
|
"indicator--572758b2-6254-430b-8434-4ceb02de0b81",
|
|
"observed-data--572758b2-5258-44a2-aea6-467902de0b81",
|
|
"url--572758b2-5258-44a2-aea6-467902de0b81",
|
|
"indicator--572758b3-f0bc-467e-b31a-4d9a02de0b81",
|
|
"observed-data--572758b3-aaf8-4359-b916-40b702de0b81",
|
|
"url--572758b3-aaf8-4359-b916-40b702de0b81",
|
|
"indicator--572758b3-4d74-4064-a71c-499502de0b81",
|
|
"indicator--572758b4-8ccc-4017-9c25-431102de0b81",
|
|
"observed-data--572758b4-de38-4388-ba72-445402de0b81",
|
|
"url--572758b4-de38-4388-ba72-445402de0b81",
|
|
"indicator--572758b5-c964-4273-9fef-401102de0b81",
|
|
"indicator--572758b5-c380-4a5f-8ba8-4e1102de0b81",
|
|
"observed-data--572758b5-2fac-4e76-8f9f-4c7602de0b81",
|
|
"url--572758b5-2fac-4e76-8f9f-4c7602de0b81",
|
|
"indicator--572758b6-4400-4fb8-a8e5-47ee02de0b81",
|
|
"indicator--572758b6-99d0-429b-8b2d-47bc02de0b81",
|
|
"observed-data--572758b6-4b64-408f-b786-4b7702de0b81",
|
|
"url--572758b6-4b64-408f-b786-4b7702de0b81",
|
|
"indicator--572758b7-f704-44bd-98ff-449702de0b81",
|
|
"indicator--572758b7-5098-42d2-8c27-4e3602de0b81",
|
|
"observed-data--572758b7-ceac-43df-9a2f-493302de0b81",
|
|
"url--572758b7-ceac-43df-9a2f-493302de0b81",
|
|
"indicator--572758b8-30fc-4908-9aa3-4b5002de0b81",
|
|
"indicator--572758b8-5248-41f1-897f-488a02de0b81",
|
|
"observed-data--572758b8-6490-4c9e-9e9e-44fa02de0b81",
|
|
"url--572758b8-6490-4c9e-9e9e-44fa02de0b81",
|
|
"indicator--572758b9-41fc-48e2-abc0-4b2c02de0b81",
|
|
"indicator--572758b9-2d58-4e12-b98a-43f002de0b81",
|
|
"observed-data--572758ba-2d84-47d0-8335-4dc702de0b81",
|
|
"url--572758ba-2d84-47d0-8335-4dc702de0b81",
|
|
"indicator--572758ba-f4c8-425b-99f1-44da02de0b81",
|
|
"indicator--572758bb-0360-46ba-8c2c-4fcc02de0b81",
|
|
"observed-data--572758bb-ee50-4a20-9112-419f02de0b81",
|
|
"url--572758bb-ee50-4a20-9112-419f02de0b81",
|
|
"indicator--572758bb-6b94-429a-9e99-437602de0b81",
|
|
"indicator--572758bc-1618-4246-915c-44ff02de0b81",
|
|
"observed-data--572758bc-e28c-4484-91af-4eb102de0b81",
|
|
"url--572758bc-e28c-4484-91af-4eb102de0b81",
|
|
"indicator--572758bd-ae14-4c76-8ae3-4a2602de0b81",
|
|
"indicator--572758bd-0d08-4e44-818d-424e02de0b81",
|
|
"observed-data--572758bd-6208-45c4-a020-49ec02de0b81",
|
|
"url--572758bd-6208-45c4-a020-49ec02de0b81",
|
|
"indicator--572758be-3f88-4cd4-95f1-458e02de0b81",
|
|
"indicator--572758be-17c0-4e95-ab6e-4dd502de0b81",
|
|
"observed-data--572758bf-c5e4-45f0-a918-48e202de0b81",
|
|
"url--572758bf-c5e4-45f0-a918-48e202de0b81",
|
|
"indicator--572758bf-14ec-42ca-8dbe-420402de0b81",
|
|
"indicator--572758bf-fc74-4773-bdad-476302de0b81",
|
|
"observed-data--572758c0-b464-451b-aed4-449402de0b81",
|
|
"url--572758c0-b464-451b-aed4-449402de0b81",
|
|
"indicator--572758c0-b76c-4537-bb51-411402de0b81",
|
|
"indicator--572758c1-4af8-4c8e-83b0-492402de0b81",
|
|
"observed-data--572758c1-ffec-466f-907b-433202de0b81",
|
|
"url--572758c1-ffec-466f-907b-433202de0b81",
|
|
"indicator--572758c2-9c4c-4533-b47f-4a2102de0b81",
|
|
"indicator--572758c2-3c98-437f-8c81-486c02de0b81",
|
|
"observed-data--572758c2-0e24-4f8d-8982-4bb202de0b81",
|
|
"url--572758c2-0e24-4f8d-8982-4bb202de0b81",
|
|
"indicator--572758c3-c6a4-4f27-b3a4-443402de0b81",
|
|
"indicator--572758c3-b744-405d-b901-438802de0b81",
|
|
"observed-data--572758c4-5438-479d-ba4f-49e202de0b81",
|
|
"url--572758c4-5438-479d-ba4f-49e202de0b81",
|
|
"indicator--572758c4-abf4-4ab8-9faf-43ee02de0b81",
|
|
"indicator--572758c4-75b8-47ec-b330-454302de0b81",
|
|
"observed-data--572758c5-fa50-4d2a-95c9-402b02de0b81",
|
|
"url--572758c5-fa50-4d2a-95c9-402b02de0b81",
|
|
"indicator--572758c5-44d4-487c-bfeb-466a02de0b81",
|
|
"indicator--572758c6-23cc-45b8-905f-456702de0b81",
|
|
"observed-data--572758c6-cbf0-4ced-b08f-487902de0b81",
|
|
"url--572758c6-cbf0-4ced-b08f-487902de0b81",
|
|
"indicator--572758c6-2940-4ead-b7b3-4dd102de0b81",
|
|
"indicator--572758c7-c090-48f7-a3c3-429802de0b81",
|
|
"observed-data--572758c7-d208-4153-b9a8-4dff02de0b81",
|
|
"url--572758c7-d208-4153-b9a8-4dff02de0b81",
|
|
"indicator--572758c8-ed40-4950-9e3a-4b1c02de0b81",
|
|
"indicator--572758c8-67b8-4ee8-bbf5-46b102de0b81",
|
|
"observed-data--572758c9-8eb4-4c51-9494-42ec02de0b81",
|
|
"url--572758c9-8eb4-4c51-9494-42ec02de0b81",
|
|
"indicator--572758c9-11dc-47bd-87e4-474b02de0b81",
|
|
"indicator--572758c9-ea04-492a-82df-44ee02de0b81",
|
|
"observed-data--572758ca-a614-4205-b2b6-490702de0b81",
|
|
"url--572758ca-a614-4205-b2b6-490702de0b81",
|
|
"indicator--572758ca-2648-4e1a-a2cb-4ac602de0b81",
|
|
"indicator--572758cb-b6b4-4f13-a332-471b02de0b81",
|
|
"observed-data--572758cb-e644-4b6f-a3ad-465b02de0b81",
|
|
"url--572758cb-e644-4b6f-a3ad-465b02de0b81",
|
|
"indicator--572758cb-0d58-45e0-a486-40ee02de0b81",
|
|
"indicator--572758cc-cd10-4dc4-a60f-4f0c02de0b81",
|
|
"observed-data--572758cc-7be8-469b-8243-4d5302de0b81",
|
|
"url--572758cc-7be8-469b-8243-4d5302de0b81",
|
|
"indicator--572758cc-a87c-4cf1-862b-41e202de0b81",
|
|
"indicator--572758cd-c0a0-4095-936c-4c9802de0b81",
|
|
"observed-data--572758cd-514c-4c4c-bed8-4df402de0b81",
|
|
"url--572758cd-514c-4c4c-bed8-4df402de0b81",
|
|
"indicator--572758ce-b4c0-4acf-b422-408a02de0b81",
|
|
"indicator--572758ce-d270-43c1-8bb7-4add02de0b81",
|
|
"observed-data--572758cf-4060-4209-9b2d-4c7a02de0b81",
|
|
"url--572758cf-4060-4209-9b2d-4c7a02de0b81",
|
|
"indicator--572758cf-bfb4-42d8-a52f-446302de0b81",
|
|
"indicator--572758cf-b0dc-4b49-a903-4f2302de0b81",
|
|
"observed-data--572758d0-d41c-4d85-b968-467702de0b81",
|
|
"url--572758d0-d41c-4d85-b968-467702de0b81",
|
|
"indicator--572758d0-24b4-492c-ad3c-471502de0b81",
|
|
"indicator--572758d1-5988-4031-a2da-40af02de0b81",
|
|
"observed-data--572758d1-fcfc-4195-8429-412202de0b81",
|
|
"url--572758d1-fcfc-4195-8429-412202de0b81",
|
|
"indicator--572758d1-20e8-433d-bd01-4c3b02de0b81",
|
|
"indicator--572758d2-679c-44a7-9122-447702de0b81",
|
|
"observed-data--572758d2-5bac-4567-bea8-402a02de0b81",
|
|
"url--572758d2-5bac-4567-bea8-402a02de0b81",
|
|
"indicator--572758d3-03d4-48ed-9d49-423402de0b81",
|
|
"indicator--572758d3-5a2c-4592-8440-4a1702de0b81",
|
|
"observed-data--572758d3-fa1c-4a06-892e-419b02de0b81",
|
|
"url--572758d3-fa1c-4a06-892e-419b02de0b81",
|
|
"indicator--572758d4-5a54-4651-8fa8-4e4202de0b81",
|
|
"indicator--572758d4-22ec-43f2-bebf-4fcb02de0b81",
|
|
"observed-data--572758d5-8478-447e-9272-4d2f02de0b81",
|
|
"url--572758d5-8478-447e-9272-4d2f02de0b81",
|
|
"indicator--572758d5-1df8-46b5-bf94-428002de0b81",
|
|
"indicator--572758d6-8ec0-445d-b1ca-4c3102de0b81",
|
|
"observed-data--572758d6-0b64-44d1-985f-48b002de0b81",
|
|
"url--572758d6-0b64-44d1-985f-48b002de0b81",
|
|
"indicator--572758d6-102c-415e-a7cb-4b8e02de0b81",
|
|
"indicator--572758d7-f790-457b-8e95-468d02de0b81",
|
|
"observed-data--572758d7-529c-497c-aff1-47f402de0b81",
|
|
"url--572758d7-529c-497c-aff1-47f402de0b81",
|
|
"indicator--572758d8-3ffc-43ba-83b2-407c02de0b81",
|
|
"indicator--572758d8-5a28-4975-b09c-4e9c02de0b81",
|
|
"observed-data--572758d8-41a8-4231-b4d5-4a7302de0b81",
|
|
"url--572758d8-41a8-4231-b4d5-4a7302de0b81",
|
|
"indicator--572758d9-f538-4f90-9a98-452102de0b81",
|
|
"indicator--572758d9-18e8-4d01-a271-4e2f02de0b81",
|
|
"observed-data--572758da-9c78-4407-acf2-4d6f02de0b81",
|
|
"url--572758da-9c78-4407-acf2-4d6f02de0b81",
|
|
"indicator--572758da-cfe0-4c72-b305-4eea02de0b81",
|
|
"indicator--572758da-05d0-4e42-a65a-491802de0b81",
|
|
"observed-data--572758db-e500-46a4-af07-497102de0b81",
|
|
"url--572758db-e500-46a4-af07-497102de0b81",
|
|
"indicator--572758db-3f38-443a-8d3f-478b02de0b81",
|
|
"indicator--572758dc-56f8-4589-81ce-454202de0b81",
|
|
"observed-data--572758dc-e1e0-468f-85bb-4be102de0b81",
|
|
"url--572758dc-e1e0-468f-85bb-4be102de0b81",
|
|
"indicator--572758dc-0b20-4e39-866e-4b3b02de0b81",
|
|
"indicator--572758dd-8610-469d-b47c-449102de0b81",
|
|
"observed-data--572758dd-e468-4f64-b935-43a702de0b81",
|
|
"url--572758dd-e468-4f64-b935-43a702de0b81",
|
|
"indicator--572758de-bb20-4db7-8bdb-401b02de0b81",
|
|
"indicator--572758de-5854-484f-a4cd-484e02de0b81",
|
|
"observed-data--572758df-4d08-4db1-92da-437902de0b81",
|
|
"url--572758df-4d08-4db1-92da-437902de0b81",
|
|
"indicator--572758df-9380-4c3f-85a4-440d02de0b81",
|
|
"indicator--572758df-b4a8-4aa4-af14-4a6402de0b81",
|
|
"observed-data--572758e0-120c-45bd-8ff7-411d02de0b81",
|
|
"url--572758e0-120c-45bd-8ff7-411d02de0b81",
|
|
"indicator--572758e0-cdc8-43f5-8428-459d02de0b81",
|
|
"indicator--572758e0-09f0-48ed-a939-415c02de0b81",
|
|
"observed-data--572758e1-553c-4525-9cec-4bcd02de0b81",
|
|
"url--572758e1-553c-4525-9cec-4bcd02de0b81",
|
|
"indicator--572758e1-5640-4c51-8471-436702de0b81",
|
|
"indicator--572758e2-cb30-4bdf-9869-475b02de0b81",
|
|
"observed-data--572758e2-50bc-4286-acc2-4ad602de0b81",
|
|
"url--572758e2-50bc-4286-acc2-4ad602de0b81",
|
|
"indicator--572758e2-baa4-4788-97f5-442c02de0b81",
|
|
"indicator--572758e3-58b8-4a87-ad7b-40cb02de0b81",
|
|
"observed-data--572758e3-61c4-41f8-89e7-472d02de0b81",
|
|
"url--572758e3-61c4-41f8-89e7-472d02de0b81",
|
|
"indicator--572758e4-675c-4879-9fd9-454502de0b81",
|
|
"indicator--572758e4-3a04-490d-a4bf-43f202de0b81",
|
|
"observed-data--572758e4-d06c-41a8-869f-4ddb02de0b81",
|
|
"url--572758e4-d06c-41a8-869f-4ddb02de0b81",
|
|
"indicator--572758e5-e31c-4208-81c4-43e802de0b81",
|
|
"indicator--572758e5-9a0c-4fc7-93d9-4e3902de0b81",
|
|
"observed-data--572758e6-d29c-4f7b-8150-4a7102de0b81",
|
|
"url--572758e6-d29c-4f7b-8150-4a7102de0b81",
|
|
"indicator--572758e6-c6d8-4425-b91b-498c02de0b81",
|
|
"indicator--572758e6-33c0-4c1b-b2ab-4f4802de0b81",
|
|
"observed-data--572758e7-2d4c-4ceb-a7c2-4ad002de0b81",
|
|
"url--572758e7-2d4c-4ceb-a7c2-4ad002de0b81",
|
|
"indicator--572758e7-3c2c-41f8-bdf2-4ccc02de0b81",
|
|
"indicator--572758e7-2110-40b2-a9d1-4df602de0b81",
|
|
"observed-data--572758e8-f0d4-4ff9-8351-4f1202de0b81",
|
|
"url--572758e8-f0d4-4ff9-8351-4f1202de0b81",
|
|
"indicator--572758e8-342c-46bb-b12f-4c3c02de0b81",
|
|
"indicator--572758e8-c410-4b29-8824-455d02de0b81",
|
|
"observed-data--572758e9-7ab0-4e7c-8be4-406602de0b81",
|
|
"url--572758e9-7ab0-4e7c-8be4-406602de0b81",
|
|
"indicator--572758e9-bda4-469b-9279-46d002de0b81",
|
|
"indicator--572758ea-1aec-48eb-91cd-4a9802de0b81",
|
|
"observed-data--572758ea-4f3c-4c39-8012-489902de0b81",
|
|
"url--572758ea-4f3c-4c39-8012-489902de0b81",
|
|
"indicator--572758ea-9ee8-48bf-8083-4a4002de0b81",
|
|
"indicator--572758eb-b110-40fc-b7e1-482102de0b81",
|
|
"observed-data--572758eb-cc6c-4786-b56d-40a602de0b81",
|
|
"url--572758eb-cc6c-4786-b56d-40a602de0b81",
|
|
"indicator--572758eb-b774-4176-a5f0-4ea102de0b81",
|
|
"indicator--572758ec-2860-48fb-9ed8-465402de0b81",
|
|
"observed-data--572758ec-0718-496c-82cc-455002de0b81",
|
|
"url--572758ec-0718-496c-82cc-455002de0b81",
|
|
"indicator--572758ec-4ce8-43a6-b6ba-416302de0b81",
|
|
"indicator--572758ed-844c-4661-b3dd-465602de0b81",
|
|
"observed-data--572758ed-1b40-4735-a6aa-467802de0b81",
|
|
"url--572758ed-1b40-4735-a6aa-467802de0b81",
|
|
"indicator--572758ee-519c-485b-97fd-44c402de0b81",
|
|
"indicator--572758ee-4904-4190-a1cc-494502de0b81",
|
|
"observed-data--572758ee-70e4-4592-b7d1-4ccc02de0b81",
|
|
"url--572758ee-70e4-4592-b7d1-4ccc02de0b81",
|
|
"indicator--572758ef-07b0-4030-83f0-436302de0b81",
|
|
"indicator--572758ef-d3a8-44ae-b01e-40fb02de0b81",
|
|
"observed-data--572758f0-1b90-4e23-a256-421f02de0b81",
|
|
"url--572758f0-1b90-4e23-a256-421f02de0b81",
|
|
"indicator--572758f0-2dc8-4d9f-a405-4ec902de0b81",
|
|
"indicator--572758f0-5be4-4ebd-95b3-41e502de0b81",
|
|
"observed-data--572758f1-5908-4870-a6c0-4eaa02de0b81",
|
|
"url--572758f1-5908-4870-a6c0-4eaa02de0b81",
|
|
"indicator--572758f1-484c-45a9-a46d-4a5702de0b81",
|
|
"indicator--572758f2-0dd8-4e85-a6f3-44e902de0b81",
|
|
"observed-data--572758f2-db7c-4f5b-a58e-4ec702de0b81",
|
|
"url--572758f2-db7c-4f5b-a58e-4ec702de0b81",
|
|
"indicator--572758f2-1354-443f-89d6-436d02de0b81",
|
|
"indicator--572758f3-df20-4087-a8ef-441202de0b81",
|
|
"observed-data--572758f3-89c0-4f68-9acc-45d602de0b81",
|
|
"url--572758f3-89c0-4f68-9acc-45d602de0b81",
|
|
"indicator--572758f4-b028-4d42-b087-4a6902de0b81",
|
|
"indicator--572758f4-14b0-49ac-b183-499c02de0b81",
|
|
"observed-data--572758f4-1c54-4996-a37c-49e402de0b81",
|
|
"url--572758f4-1c54-4996-a37c-49e402de0b81",
|
|
"indicator--572758f5-ea6c-4d56-8ec4-4c8302de0b81",
|
|
"indicator--572758f5-324c-4daa-a8b1-427802de0b81",
|
|
"observed-data--572758f6-bce0-49be-af23-4bfd02de0b81",
|
|
"url--572758f6-bce0-49be-af23-4bfd02de0b81",
|
|
"indicator--572758f6-0844-4e96-8bee-42c602de0b81",
|
|
"indicator--572758f6-0840-4af4-b9b1-45ee02de0b81",
|
|
"observed-data--572758f6-9544-4f3b-b6eb-4faf02de0b81",
|
|
"url--572758f6-9544-4f3b-b6eb-4faf02de0b81",
|
|
"indicator--572758f7-a0bc-48eb-9d87-4ffc02de0b81",
|
|
"indicator--572758f7-4ac4-497e-9866-45fc02de0b81",
|
|
"observed-data--572758f8-4ea8-460a-ae85-47d302de0b81",
|
|
"url--572758f8-4ea8-460a-ae85-47d302de0b81",
|
|
"indicator--572758f8-6bcc-44e2-8701-4a6102de0b81",
|
|
"indicator--572758f8-94e0-4d6a-85f7-419402de0b81",
|
|
"observed-data--572758f9-b4b0-45ff-a2ca-4b1102de0b81",
|
|
"url--572758f9-b4b0-45ff-a2ca-4b1102de0b81",
|
|
"indicator--572758f9-7e8c-434f-9043-49c202de0b81",
|
|
"indicator--572758fa-6f6c-41c2-a4ed-43a902de0b81",
|
|
"observed-data--572758fa-b4fc-4a11-acc4-4aac02de0b81",
|
|
"url--572758fa-b4fc-4a11-acc4-4aac02de0b81",
|
|
"indicator--572758fa-0700-4846-b8e8-41a702de0b81",
|
|
"indicator--572758fb-e55c-42cb-b8bd-47e602de0b81",
|
|
"observed-data--572758fb-8ef4-40b2-8f8e-4c5e02de0b81",
|
|
"url--572758fb-8ef4-40b2-8f8e-4c5e02de0b81",
|
|
"indicator--572758fc-9f84-4936-89a7-4c0702de0b81",
|
|
"indicator--572758fc-8a08-4f48-a27e-420e02de0b81",
|
|
"observed-data--572758fc-4830-4e7b-b1e8-428002de0b81",
|
|
"url--572758fc-4830-4e7b-b1e8-428002de0b81",
|
|
"indicator--572758fd-06cc-4eb2-ae5f-425602de0b81",
|
|
"indicator--572758fd-0b3c-4c5c-9bdd-478902de0b81",
|
|
"observed-data--572758fe-2f18-4daa-a338-4c8d02de0b81",
|
|
"url--572758fe-2f18-4daa-a338-4c8d02de0b81",
|
|
"indicator--572758fe-0cb4-4019-b87c-442a02de0b81",
|
|
"indicator--572758ff-f4a0-4276-a0aa-4a9102de0b81",
|
|
"observed-data--572758ff-b2e4-4a16-a196-4c5902de0b81",
|
|
"url--572758ff-b2e4-4a16-a196-4c5902de0b81",
|
|
"indicator--572758ff-d98c-443e-93b8-422102de0b81",
|
|
"indicator--57275900-3d4c-4f44-ac29-498502de0b81",
|
|
"observed-data--57275900-5bcc-419b-a5c1-4f6302de0b81",
|
|
"url--57275900-5bcc-419b-a5c1-4f6302de0b81",
|
|
"indicator--57275901-bc68-4132-949d-405b02de0b81",
|
|
"indicator--57275901-2d04-495c-a2d1-4ab002de0b81",
|
|
"observed-data--57275901-1f3c-4a9d-be28-4f1e02de0b81",
|
|
"url--57275901-1f3c-4a9d-be28-4f1e02de0b81",
|
|
"indicator--57275902-e360-43b1-b75d-44d902de0b81",
|
|
"indicator--57275902-6278-49cf-8970-405502de0b81",
|
|
"observed-data--57275903-4c34-44db-b75d-486602de0b81",
|
|
"url--57275903-4c34-44db-b75d-486602de0b81",
|
|
"indicator--57275903-a698-4c88-b90e-491202de0b81",
|
|
"indicator--57275903-90f8-46f8-82b4-4e2602de0b81",
|
|
"observed-data--57275904-180c-4afc-a7f3-4a6302de0b81",
|
|
"url--57275904-180c-4afc-a7f3-4a6302de0b81",
|
|
"indicator--57275904-d5f0-40cc-8d5b-426b02de0b81",
|
|
"indicator--57275905-9fc8-4e96-a6d8-431002de0b81",
|
|
"observed-data--57275905-c144-40d0-8fac-4e1502de0b81",
|
|
"url--57275905-c144-40d0-8fac-4e1502de0b81",
|
|
"indicator--57275906-c538-4a28-a515-4c7c02de0b81",
|
|
"indicator--57275906-9c6c-417b-98e6-489102de0b81",
|
|
"observed-data--57275906-ef34-4dd5-acb5-40d002de0b81",
|
|
"url--57275906-ef34-4dd5-acb5-40d002de0b81",
|
|
"indicator--57275907-676c-45dc-b9c9-4e7702de0b81",
|
|
"indicator--57275907-26c0-4cf3-9cb0-4c8202de0b81",
|
|
"observed-data--57275908-81b0-4126-8504-4b5e02de0b81",
|
|
"url--57275908-81b0-4126-8504-4b5e02de0b81",
|
|
"indicator--57275908-0e70-43e5-ac25-4e3802de0b81",
|
|
"indicator--57275908-3774-4409-b446-4c6102de0b81",
|
|
"observed-data--57275909-daa8-4e94-8361-40ee02de0b81",
|
|
"url--57275909-daa8-4e94-8361-40ee02de0b81",
|
|
"indicator--57275909-8fa4-45cd-9d71-42f202de0b81",
|
|
"indicator--5727590a-7ac4-407a-96bc-4e6902de0b81",
|
|
"observed-data--5727590a-cdac-4c7e-8939-412802de0b81",
|
|
"url--5727590a-cdac-4c7e-8939-412802de0b81",
|
|
"indicator--5727590a-c294-4a32-91cd-476302de0b81",
|
|
"indicator--5727590b-7f50-4885-a3e5-432102de0b81",
|
|
"observed-data--5727590b-d0a0-4c38-9e93-4b1202de0b81",
|
|
"url--5727590b-d0a0-4c38-9e93-4b1202de0b81",
|
|
"indicator--5727590c-94b0-4fcd-a3d0-478e02de0b81",
|
|
"indicator--5727590c-01d0-402b-b195-486a02de0b81",
|
|
"observed-data--5727590d-4270-4cb9-9946-497b02de0b81",
|
|
"url--5727590d-4270-4cb9-9946-497b02de0b81",
|
|
"indicator--5727590d-4dc0-4058-9bc2-4b8802de0b81",
|
|
"indicator--5727590d-1298-4a08-b51d-425e02de0b81",
|
|
"observed-data--5727590e-a710-46b7-895f-448002de0b81",
|
|
"url--5727590e-a710-46b7-895f-448002de0b81",
|
|
"indicator--5727590e-7ab0-413f-be00-464f02de0b81",
|
|
"indicator--5727590f-6364-4a89-b929-40fb02de0b81",
|
|
"observed-data--5727590f-1d80-4a0e-88ef-44a902de0b81",
|
|
"url--5727590f-1d80-4a0e-88ef-44a902de0b81",
|
|
"indicator--5727590f-0390-4958-98c1-46c202de0b81",
|
|
"indicator--57275910-48d8-4e32-8d95-4deb02de0b81",
|
|
"observed-data--57275910-e054-49d1-bfe1-4ca102de0b81",
|
|
"url--57275910-e054-49d1-bfe1-4ca102de0b81",
|
|
"indicator--57275911-30e0-4a32-9845-4a2002de0b81",
|
|
"indicator--57275911-abac-4364-944b-44da02de0b81",
|
|
"observed-data--57275911-fac0-43ad-b9da-445502de0b81",
|
|
"url--57275911-fac0-43ad-b9da-445502de0b81",
|
|
"indicator--57275912-db7c-428b-99f8-4d6002de0b81",
|
|
"indicator--57275912-edd8-4693-aa30-46d702de0b81",
|
|
"observed-data--57275913-30d0-46ea-81b1-491402de0b81",
|
|
"url--57275913-30d0-46ea-81b1-491402de0b81",
|
|
"indicator--57275913-9d5c-48ca-8c0a-4e4802de0b81",
|
|
"indicator--57275914-33a4-4513-a872-4ffd02de0b81",
|
|
"observed-data--57275914-08f4-41a9-ae36-405402de0b81",
|
|
"url--57275914-08f4-41a9-ae36-405402de0b81",
|
|
"indicator--57275914-3338-4eae-978d-464002de0b81",
|
|
"indicator--57275915-c18c-4385-aa5d-4e8102de0b81",
|
|
"observed-data--57275915-873c-4cba-a3dd-44c202de0b81",
|
|
"url--57275915-873c-4cba-a3dd-44c202de0b81",
|
|
"indicator--57275916-8520-4578-9cf5-4dc002de0b81",
|
|
"indicator--57275916-86c4-4638-858c-464b02de0b81",
|
|
"observed-data--57275916-06a4-4c08-ac3a-4c6402de0b81",
|
|
"url--57275916-06a4-4c08-ac3a-4c6402de0b81",
|
|
"indicator--57275917-263c-48d6-a38a-4cd402de0b81",
|
|
"indicator--57275917-2a00-450a-8b40-45b002de0b81",
|
|
"observed-data--57275918-24d0-40c4-a505-4fa902de0b81",
|
|
"url--57275918-24d0-40c4-a505-4fa902de0b81",
|
|
"indicator--57275918-e498-4416-8d79-478b02de0b81",
|
|
"indicator--57275919-d710-4ebd-8f7b-493a02de0b81",
|
|
"observed-data--57275919-be18-47b1-8d7a-47bf02de0b81",
|
|
"url--57275919-be18-47b1-8d7a-47bf02de0b81",
|
|
"indicator--57275919-f780-48e2-a6c4-49f502de0b81",
|
|
"indicator--5727591a-1bf8-42c0-b820-41eb02de0b81",
|
|
"observed-data--5727591a-447c-4555-8ad8-415902de0b81",
|
|
"url--5727591a-447c-4555-8ad8-415902de0b81",
|
|
"indicator--5727591b-f89c-4faa-ac1a-484f02de0b81",
|
|
"indicator--5727591b-03c4-43c0-af14-411002de0b81",
|
|
"observed-data--5727591b-2928-489c-a9d1-493e02de0b81",
|
|
"url--5727591b-2928-489c-a9d1-493e02de0b81",
|
|
"indicator--5727591c-8f68-4f15-8013-4ccd02de0b81",
|
|
"indicator--5727591c-3590-4dd7-8742-4b4902de0b81",
|
|
"observed-data--5727591d-4c00-47c1-b36e-4ea602de0b81",
|
|
"url--5727591d-4c00-47c1-b36e-4ea602de0b81",
|
|
"indicator--5727591d-7b40-4ec9-a05a-4f1902de0b81",
|
|
"indicator--5727591d-0a9c-4ff7-8977-4b8402de0b81",
|
|
"observed-data--5727591e-7590-46d6-b83d-46e702de0b81",
|
|
"url--5727591e-7590-46d6-b83d-46e702de0b81",
|
|
"indicator--5727591e-efd0-42a1-837f-47cb02de0b81",
|
|
"indicator--5727591f-6434-4394-88ec-45a302de0b81",
|
|
"observed-data--5727591f-a708-4b8e-8b55-41c102de0b81",
|
|
"url--5727591f-a708-4b8e-8b55-41c102de0b81",
|
|
"indicator--57275920-dd90-4ec7-8c9d-4e6902de0b81",
|
|
"indicator--57275920-cbfc-4e0d-baba-460d02de0b81",
|
|
"observed-data--57275920-e178-41d0-bc89-4ae402de0b81",
|
|
"url--57275920-e178-41d0-bc89-4ae402de0b81",
|
|
"indicator--57275921-9ea8-43d4-8414-445202de0b81",
|
|
"indicator--57275921-90fc-487b-9235-49a902de0b81",
|
|
"observed-data--57275922-15e4-4ee3-ab55-489802de0b81",
|
|
"url--57275922-15e4-4ee3-ab55-489802de0b81",
|
|
"indicator--57275922-9064-4274-8a04-40da02de0b81",
|
|
"indicator--57275922-7c0c-4915-9803-415402de0b81",
|
|
"observed-data--57275923-3278-4a44-9ece-4b1802de0b81",
|
|
"url--57275923-3278-4a44-9ece-4b1802de0b81",
|
|
"indicator--57275923-efd4-49eb-a56c-4de302de0b81",
|
|
"indicator--57275924-dae0-42a2-81b8-4eaf02de0b81",
|
|
"observed-data--57275924-4218-4178-972b-477502de0b81",
|
|
"url--57275924-4218-4178-972b-477502de0b81",
|
|
"indicator--57275924-8a98-4e89-8951-4ae402de0b81",
|
|
"indicator--57275925-6824-4951-be7f-4e5002de0b81",
|
|
"observed-data--57275925-3a54-42c5-9cc2-4e0d02de0b81",
|
|
"url--57275925-3a54-42c5-9cc2-4e0d02de0b81",
|
|
"indicator--57275926-d338-4aaa-a1d5-4ed002de0b81",
|
|
"indicator--57275926-572c-4fcc-9eb9-446b02de0b81",
|
|
"observed-data--57275927-dec0-4c36-9aa3-461902de0b81",
|
|
"url--57275927-dec0-4c36-9aa3-461902de0b81",
|
|
"indicator--57275927-d3cc-4966-9cd4-492c02de0b81",
|
|
"indicator--57275927-9ce4-4891-8a68-418902de0b81",
|
|
"observed-data--57275928-3384-419c-8313-433502de0b81",
|
|
"url--57275928-3384-419c-8313-433502de0b81",
|
|
"indicator--57275928-7c44-4c09-91d6-405302de0b81",
|
|
"indicator--57275929-0524-4c84-9a20-48cd02de0b81",
|
|
"observed-data--57275929-a950-4ffe-87a4-468e02de0b81",
|
|
"url--57275929-a950-4ffe-87a4-468e02de0b81",
|
|
"indicator--57275929-dc8c-4f88-93aa-468002de0b81",
|
|
"indicator--5727592a-801c-4ba3-9632-4ca402de0b81",
|
|
"observed-data--5727592a-4e1c-48f1-8139-4eef02de0b81",
|
|
"url--5727592a-4e1c-48f1-8139-4eef02de0b81",
|
|
"indicator--5727592b-18cc-49e8-ac69-468a02de0b81",
|
|
"indicator--5727592b-ef14-40ff-9e0b-48d802de0b81",
|
|
"observed-data--5727592b-0628-4b0f-ac47-409902de0b81",
|
|
"url--5727592b-0628-4b0f-ac47-409902de0b81",
|
|
"indicator--5727592c-5c30-49f9-bbc3-4c2502de0b81",
|
|
"indicator--5727592c-64c8-431d-9c53-4d8902de0b81",
|
|
"observed-data--5727592d-5e50-4926-81ba-416e02de0b81",
|
|
"url--5727592d-5e50-4926-81ba-416e02de0b81",
|
|
"indicator--5727592d-cbcc-4138-b820-48c202de0b81",
|
|
"indicator--5727592e-0d64-4af2-910a-472102de0b81",
|
|
"observed-data--5727592e-c53c-4e94-ae6b-414102de0b81",
|
|
"url--5727592e-c53c-4e94-ae6b-414102de0b81",
|
|
"indicator--5727592e-95c0-4212-8b7a-4c4c02de0b81",
|
|
"indicator--5727592f-e0b8-4c9c-a089-4cc502de0b81",
|
|
"observed-data--5727592f-54e4-4b59-8932-47b602de0b81",
|
|
"url--5727592f-54e4-4b59-8932-47b602de0b81",
|
|
"indicator--57275930-4fb0-4874-8d15-488102de0b81",
|
|
"indicator--57275930-7c94-4e31-a38f-429002de0b81",
|
|
"observed-data--57275930-716c-44dc-8487-42a202de0b81",
|
|
"url--57275930-716c-44dc-8487-42a202de0b81",
|
|
"indicator--57275931-63ac-4e34-9ba9-44ed02de0b81",
|
|
"indicator--57275931-99e8-4b3c-81f1-415902de0b81",
|
|
"observed-data--57275932-0b0c-4a1b-a954-4c1602de0b81",
|
|
"url--57275932-0b0c-4a1b-a954-4c1602de0b81",
|
|
"indicator--57275932-2e68-4736-a134-424802de0b81",
|
|
"indicator--57275933-4354-419b-9c39-42f502de0b81",
|
|
"observed-data--57275933-7890-4f73-8e61-4f7b02de0b81",
|
|
"url--57275933-7890-4f73-8e61-4f7b02de0b81",
|
|
"indicator--57275933-7828-4593-a19f-442002de0b81",
|
|
"indicator--57275934-9954-4ef6-aa29-419702de0b81",
|
|
"observed-data--57275934-29f0-45f1-844e-49de02de0b81",
|
|
"url--57275934-29f0-45f1-844e-49de02de0b81",
|
|
"indicator--57275935-d830-4d74-8fd6-48b402de0b81",
|
|
"indicator--57275935-c4a8-4662-a0a5-459f02de0b81",
|
|
"observed-data--57275935-fe30-4ad4-9aea-46ad02de0b81",
|
|
"url--57275935-fe30-4ad4-9aea-46ad02de0b81",
|
|
"indicator--57275936-d4c8-4569-ad22-4ca102de0b81",
|
|
"indicator--57275936-c250-42b3-b442-468a02de0b81",
|
|
"observed-data--57275937-3a78-451a-8a55-4d6d02de0b81",
|
|
"url--57275937-3a78-451a-8a55-4d6d02de0b81",
|
|
"indicator--57275937-eeec-4df3-bd5b-484202de0b81",
|
|
"indicator--57275938-63d8-4451-a3e6-4d2c02de0b81",
|
|
"observed-data--57275938-99c8-4afb-a109-427902de0b81",
|
|
"url--57275938-99c8-4afb-a109-427902de0b81",
|
|
"indicator--57275938-2f0c-47cc-a37f-4d1702de0b81",
|
|
"indicator--57275939-1264-44e7-bc31-49ac02de0b81",
|
|
"observed-data--57275939-98f0-4269-9948-4e3702de0b81",
|
|
"url--57275939-98f0-4269-9948-4e3702de0b81",
|
|
"indicator--5727593a-f394-45a7-afc1-430102de0b81",
|
|
"indicator--5727593a-8c20-4489-bf0e-4cfe02de0b81",
|
|
"observed-data--5727593a-7ed4-4d30-bc93-4f0202de0b81",
|
|
"url--5727593a-7ed4-4d30-bc93-4f0202de0b81",
|
|
"indicator--5727593b-d868-4b0d-a84b-4aad02de0b81",
|
|
"indicator--5727593b-2874-47d2-8e00-4b8202de0b81",
|
|
"observed-data--5727593c-30e4-45e2-96b1-461202de0b81",
|
|
"url--5727593c-30e4-45e2-96b1-461202de0b81",
|
|
"indicator--5727593c-e094-4811-a808-409602de0b81",
|
|
"indicator--5727593c-eb34-4626-8785-44d702de0b81",
|
|
"observed-data--5727593d-8994-48dc-8f1c-439602de0b81",
|
|
"url--5727593d-8994-48dc-8f1c-439602de0b81",
|
|
"indicator--5727593d-d91c-4f19-8d85-4f8302de0b81",
|
|
"indicator--5727593e-57d0-4508-9c98-46d502de0b81",
|
|
"observed-data--5727593e-4be0-470e-ad2d-4fce02de0b81",
|
|
"url--5727593e-4be0-470e-ad2d-4fce02de0b81",
|
|
"indicator--5727593f-be90-417d-8553-49a102de0b81",
|
|
"indicator--5727593f-1ae4-4102-a6ee-48e102de0b81",
|
|
"observed-data--5727593f-5be8-44e8-9a50-411902de0b81",
|
|
"url--5727593f-5be8-44e8-9a50-411902de0b81",
|
|
"indicator--57275940-6ff4-4169-b4f7-455502de0b81",
|
|
"indicator--57275940-96c4-4e7b-b317-4e4f02de0b81",
|
|
"observed-data--57275941-eef8-4fc3-8a6e-4ee102de0b81",
|
|
"url--57275941-eef8-4fc3-8a6e-4ee102de0b81",
|
|
"indicator--57275941-dff8-4753-aa72-420702de0b81",
|
|
"indicator--57275941-030c-4327-be7e-430102de0b81",
|
|
"observed-data--57275942-3664-4140-bfb6-45b102de0b81",
|
|
"url--57275942-3664-4140-bfb6-45b102de0b81",
|
|
"indicator--57275942-ffc4-4b5e-8589-42a802de0b81",
|
|
"indicator--57275943-54ac-47dd-a81b-480102de0b81",
|
|
"observed-data--57275943-e3d0-4fb1-8955-47eb02de0b81",
|
|
"url--57275943-e3d0-4fb1-8955-47eb02de0b81",
|
|
"indicator--57275943-cf18-409b-b4a0-4f8d02de0b81",
|
|
"indicator--57275944-3048-465e-b5f8-4d8f02de0b81",
|
|
"observed-data--57275944-edc4-44d7-8f97-4a8102de0b81",
|
|
"url--57275944-edc4-44d7-8f97-4a8102de0b81",
|
|
"indicator--57275945-f24c-469c-a535-497202de0b81",
|
|
"indicator--57275945-be34-4e76-a346-472f02de0b81",
|
|
"observed-data--57275946-0168-4dab-afb2-4b2a02de0b81",
|
|
"url--57275946-0168-4dab-afb2-4b2a02de0b81",
|
|
"indicator--57275946-8cf4-4a63-bf70-4b1a02de0b81",
|
|
"indicator--57275946-7fec-4be2-840c-40fe02de0b81",
|
|
"observed-data--57275947-8338-4ff2-b7c4-452502de0b81",
|
|
"url--57275947-8338-4ff2-b7c4-452502de0b81",
|
|
"indicator--57275947-8374-47a3-af84-470d02de0b81",
|
|
"indicator--57275948-2114-4727-bfe6-404502de0b81",
|
|
"observed-data--57275948-4e08-49dc-beba-4ce502de0b81",
|
|
"url--57275948-4e08-49dc-beba-4ce502de0b81",
|
|
"indicator--57275948-bc08-4916-a597-42ed02de0b81",
|
|
"indicator--57275949-1ce8-4500-87b0-490d02de0b81",
|
|
"observed-data--57275949-b3b8-4a9c-a9e9-410b02de0b81",
|
|
"url--57275949-b3b8-4a9c-a9e9-410b02de0b81",
|
|
"indicator--5727594a-281c-4c97-9597-424502de0b81",
|
|
"indicator--5727594a-ad60-4b23-ba93-4d0e02de0b81",
|
|
"observed-data--5727594b-3238-416d-a563-44a902de0b81",
|
|
"url--5727594b-3238-416d-a563-44a902de0b81",
|
|
"indicator--5727594b-f254-462a-84bd-45c202de0b81",
|
|
"indicator--5727594b-97b4-4fc1-894f-448a02de0b81",
|
|
"observed-data--5727594c-f9d0-43dc-86e6-454002de0b81",
|
|
"url--5727594c-f9d0-43dc-86e6-454002de0b81",
|
|
"indicator--5727594c-f120-4529-999e-4f0102de0b81",
|
|
"indicator--5727594c-375c-465c-8db1-4d7c02de0b81",
|
|
"observed-data--5727594d-1a2c-4059-a581-449702de0b81",
|
|
"url--5727594d-1a2c-4059-a581-449702de0b81",
|
|
"indicator--5727594d-9c54-40cf-945d-4b6302de0b81",
|
|
"indicator--5727594d-14a8-4837-9874-459802de0b81",
|
|
"observed-data--5727594e-5278-4066-a0ac-4ede02de0b81",
|
|
"url--5727594e-5278-4066-a0ac-4ede02de0b81",
|
|
"indicator--5727594e-49c4-4ab8-981b-47be02de0b81",
|
|
"indicator--5727594e-ff04-4c45-a42c-4a3802de0b81",
|
|
"observed-data--5727594f-7a50-4c59-a1a5-41af02de0b81",
|
|
"url--5727594f-7a50-4c59-a1a5-41af02de0b81",
|
|
"indicator--5727594f-741c-454d-9987-45bb02de0b81",
|
|
"indicator--5727594f-8168-4304-b460-4ffc02de0b81",
|
|
"observed-data--57275950-e940-4286-8492-4b7502de0b81",
|
|
"url--57275950-e940-4286-8492-4b7502de0b81",
|
|
"indicator--57275950-cef8-437e-9fc9-4f9502de0b81",
|
|
"indicator--57275950-bc30-4754-827e-49ec02de0b81",
|
|
"observed-data--57275951-ac30-43e9-98c4-47b102de0b81",
|
|
"url--57275951-ac30-43e9-98c4-47b102de0b81",
|
|
"indicator--57275951-b854-4d28-9800-48ee02de0b81",
|
|
"indicator--57275951-9830-45e2-ad0e-42fc02de0b81",
|
|
"observed-data--57275952-bff8-48b2-a240-4ff702de0b81",
|
|
"url--57275952-bff8-48b2-a240-4ff702de0b81",
|
|
"indicator--57275952-4730-4cdb-a90e-4c3102de0b81",
|
|
"indicator--57275952-346c-4c90-baa6-489a02de0b81",
|
|
"observed-data--57275953-9c40-4b40-acdb-449102de0b81",
|
|
"url--57275953-9c40-4b40-acdb-449102de0b81",
|
|
"indicator--57275953-68ec-467a-b904-4f8302de0b81",
|
|
"indicator--57275954-4724-4934-a8b8-4b5802de0b81",
|
|
"observed-data--57275954-a7f4-4dfc-809d-47b602de0b81",
|
|
"url--57275954-a7f4-4dfc-809d-47b602de0b81",
|
|
"indicator--57275954-bd24-459b-81e2-4ea702de0b81",
|
|
"indicator--57275955-4a4c-407c-a076-4dce02de0b81",
|
|
"observed-data--57275955-db64-46d5-8bf3-474c02de0b81",
|
|
"url--57275955-db64-46d5-8bf3-474c02de0b81",
|
|
"indicator--57275956-d69c-4a98-b783-427302de0b81",
|
|
"indicator--57275956-1760-432e-a9b1-41c002de0b81",
|
|
"observed-data--57275957-f73c-4ec3-88a5-4bc002de0b81",
|
|
"url--57275957-f73c-4ec3-88a5-4bc002de0b81",
|
|
"indicator--57275957-9e44-4b9d-aab2-4c6102de0b81",
|
|
"indicator--57275957-7c78-4016-b1c9-495e02de0b81",
|
|
"observed-data--57275958-8f7c-4353-8da3-491602de0b81",
|
|
"url--57275958-8f7c-4353-8da3-491602de0b81",
|
|
"indicator--57275958-0038-40e7-84d4-42c902de0b81",
|
|
"indicator--57275959-7ba8-4fc8-9907-413402de0b81",
|
|
"observed-data--57275959-6cc4-480c-b570-44c002de0b81",
|
|
"url--57275959-6cc4-480c-b570-44c002de0b81",
|
|
"indicator--57275959-ebb4-431b-8f52-460402de0b81",
|
|
"indicator--5727595a-7184-45fd-a3a4-4c3402de0b81",
|
|
"observed-data--5727595a-9994-472b-aa50-4c7102de0b81",
|
|
"url--5727595a-9994-472b-aa50-4c7102de0b81",
|
|
"indicator--5727595a-6964-4717-8c6e-478002de0b81",
|
|
"indicator--5727595b-d704-4f84-b12d-41a302de0b81",
|
|
"observed-data--5727595b-b6b8-471e-b853-447402de0b81",
|
|
"url--5727595b-b6b8-471e-b853-447402de0b81",
|
|
"indicator--5727595c-14b0-4a66-a255-4f0f02de0b81",
|
|
"indicator--5727595c-2bf4-4e23-8931-460002de0b81",
|
|
"observed-data--5727595c-1f84-4c0b-9673-407902de0b81",
|
|
"url--5727595c-1f84-4c0b-9673-407902de0b81",
|
|
"indicator--5727595d-0378-4af1-b06c-438c02de0b81",
|
|
"indicator--5727595d-06c0-4758-830a-423702de0b81",
|
|
"observed-data--5727595d-609c-40c6-9b8d-4bd202de0b81",
|
|
"url--5727595d-609c-40c6-9b8d-4bd202de0b81",
|
|
"indicator--5727595e-02a4-4882-9e47-426802de0b81",
|
|
"indicator--5727595e-0874-4e72-927e-497702de0b81",
|
|
"observed-data--5727595e-a918-4024-9ffc-4ade02de0b81",
|
|
"url--5727595e-a918-4024-9ffc-4ade02de0b81",
|
|
"indicator--5727595f-6d30-4d1d-8590-485d02de0b81",
|
|
"indicator--5727595f-6bcc-409a-aecf-4cb502de0b81",
|
|
"observed-data--5727595f-166c-4563-a988-409202de0b81",
|
|
"url--5727595f-166c-4563-a988-409202de0b81",
|
|
"indicator--57275960-9bd0-48b9-97f7-49ad02de0b81",
|
|
"indicator--57275960-301c-4518-aa86-479b02de0b81",
|
|
"observed-data--57275960-4fd8-4622-9f89-422c02de0b81",
|
|
"url--57275960-4fd8-4622-9f89-422c02de0b81",
|
|
"indicator--57275961-37a8-4ca5-b4b1-4c0702de0b81",
|
|
"indicator--57275961-016c-47c0-b6f1-472f02de0b81",
|
|
"observed-data--57275961-8d9c-40e6-bebf-40af02de0b81",
|
|
"url--57275961-8d9c-40e6-bebf-40af02de0b81",
|
|
"indicator--57275962-5858-4a5a-b601-487002de0b81",
|
|
"indicator--57275962-922c-4b7f-a35b-45c102de0b81",
|
|
"observed-data--57275962-5a68-403e-a3f4-483902de0b81",
|
|
"url--57275962-5a68-403e-a3f4-483902de0b81",
|
|
"indicator--57275963-a6d0-4e4d-9869-48f002de0b81",
|
|
"indicator--57275963-293c-46a5-8228-4d4e02de0b81",
|
|
"observed-data--57275963-efdc-468c-85a4-4a0b02de0b81",
|
|
"url--57275963-efdc-468c-85a4-4a0b02de0b81",
|
|
"indicator--57275964-f434-4c64-8f12-4d1602de0b81",
|
|
"indicator--57275964-ded8-4b06-a246-423f02de0b81",
|
|
"observed-data--57275964-ccc0-4fb3-9198-43a802de0b81",
|
|
"url--57275964-ccc0-4fb3-9198-43a802de0b81",
|
|
"indicator--57275964-e90c-4e02-b82d-4b6102de0b81",
|
|
"indicator--57275965-bde0-40b3-845f-47ee02de0b81",
|
|
"observed-data--57275965-0ba4-4bab-8925-458302de0b81",
|
|
"url--57275965-0ba4-4bab-8925-458302de0b81",
|
|
"indicator--57275965-5a50-4c87-a103-40d802de0b81",
|
|
"indicator--57275966-77cc-41ca-a96c-487502de0b81",
|
|
"observed-data--57275966-6e84-457b-93b1-465f02de0b81",
|
|
"url--57275966-6e84-457b-93b1-465f02de0b81",
|
|
"indicator--57275966-e334-4d4e-8b50-429502de0b81",
|
|
"indicator--57275967-89b4-4a28-9b51-48e102de0b81",
|
|
"observed-data--57275967-3cac-4754-bcb2-46b902de0b81",
|
|
"url--57275967-3cac-4754-bcb2-46b902de0b81",
|
|
"indicator--57275967-d194-445a-9f50-4d7502de0b81",
|
|
"indicator--57275968-bed8-4670-87fa-48d302de0b81",
|
|
"observed-data--57275968-f200-48ea-9091-401102de0b81",
|
|
"url--57275968-f200-48ea-9091-401102de0b81",
|
|
"indicator--57275968-d4c4-413b-a4e2-455202de0b81",
|
|
"indicator--57275969-accc-458e-b02e-437702de0b81",
|
|
"observed-data--57275969-7318-4ba1-9984-4d2702de0b81",
|
|
"url--57275969-7318-4ba1-9984-4d2702de0b81",
|
|
"indicator--57275969-cc30-4304-ad36-456d02de0b81",
|
|
"indicator--5727596a-d4cc-4796-8fac-4acb02de0b81",
|
|
"observed-data--5727596a-b0f4-4f6b-bc94-496202de0b81",
|
|
"url--5727596a-b0f4-4f6b-bc94-496202de0b81",
|
|
"indicator--5727596a-bc64-465a-a4a3-43d602de0b81",
|
|
"indicator--5727596b-16a0-4a5f-abaf-4e9d02de0b81",
|
|
"observed-data--5727596b-e2a4-4550-901b-4fce02de0b81",
|
|
"url--5727596b-e2a4-4550-901b-4fce02de0b81",
|
|
"indicator--5727596b-5870-4063-80d9-4b5a02de0b81",
|
|
"indicator--5727596c-272c-4fb0-b1cc-44b902de0b81",
|
|
"observed-data--5727596c-0fd8-45b6-b173-4fd002de0b81",
|
|
"url--5727596c-0fd8-45b6-b173-4fd002de0b81",
|
|
"indicator--5727596c-ea38-463e-88c0-475d02de0b81",
|
|
"indicator--5727596d-fb20-41cf-8b76-49c702de0b81",
|
|
"observed-data--5727596d-6c90-4255-9f46-4bef02de0b81",
|
|
"url--5727596d-6c90-4255-9f46-4bef02de0b81",
|
|
"x-misp-attribute--57275b70-70f4-4c03-8283-6245950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275555-4bec-4485-abc7-4749950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:41.000Z",
|
|
"modified": "2016-05-02T13:25:41.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'analyse1.mooo.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275556-95e4-4af0-93ca-4017950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:42.000Z",
|
|
"modified": "2016-05-02T13:25:42.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best.short-name.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275556-e988-4f36-a311-4611950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:42.000Z",
|
|
"modified": "2016-05-02T13:25:42.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best2.short-name.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275557-dbe0-43e0-8915-4f39950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:43.000Z",
|
|
"modified": "2016-05-02T13:25:43.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best2.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275557-455c-4d8b-acb1-4bf1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:43.000Z",
|
|
"modified": "2016-05-02T13:25:43.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best3.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275558-a790-4b03-b467-44e3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:44.000Z",
|
|
"modified": "2016-05-02T13:25:44.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best4.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275558-896c-4e1f-b489-4005950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:44.000Z",
|
|
"modified": "2016-05-02T13:25:44.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best5.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275558-aa2c-4efd-9818-453f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:44.000Z",
|
|
"modified": "2016-05-02T13:25:44.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best6.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275559-6c48-4ad5-9879-4dc5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:45.000Z",
|
|
"modified": "2016-05-02T13:25:45.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'best7.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275559-15d0-47fd-8610-4547950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:45.000Z",
|
|
"modified": "2016-05-02T13:25:45.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bestbox3.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555a-bb00-4810-a71c-4680950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:46.000Z",
|
|
"modified": "2016-05-02T13:25:46.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bestupdateserver.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555a-c4a4-4972-8371-40ea950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:46.000Z",
|
|
"modified": "2016-05-02T13:25:46.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bestupdateserver2.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555a-4214-4e00-b2f3-495d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:46.000Z",
|
|
"modified": "2016-05-02T13:25:46.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bestupser.awardspace.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555b-7120-4763-81e2-4724950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:47.000Z",
|
|
"modified": "2016-05-02T13:25:47.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bestwebstat.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555b-deb4-4511-adf6-4eec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:47.000Z",
|
|
"modified": "2016-05-02T13:25:47.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'bl2pe.bestwebstat.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555c-f5a0-405d-a4af-4320950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:48.000Z",
|
|
"modified": "2016-05-02T13:25:48.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'box4054.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555c-3220-47c8-879a-43a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:48.000Z",
|
|
"modified": "2016-05-02T13:25:48.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'c1.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555c-712c-4ccf-987a-49f2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:48.000Z",
|
|
"modified": "2016-05-02T13:25:48.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'dbook.soon.it']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555d-8d5c-4fbe-8bad-4f14950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:49.000Z",
|
|
"modified": "2016-05-02T13:25:49.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'dsite.dyx.comextd.mine.bz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555d-6acc-42d3-9697-4105950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:49.000Z",
|
|
"modified": "2016-05-02T13:25:49.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'fastecs.netfirms.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555e-95b4-49aa-96c9-4e73950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:50.000Z",
|
|
"modified": "2016-05-02T13:25:50.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'fastupdate.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555e-d8d8-4147-81b1-4f70950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:50.000Z",
|
|
"modified": "2016-05-02T13:25:50.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'gstat.strangled.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555e-5218-41a6-8ceb-4fdb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:50.000Z",
|
|
"modified": "2016-05-02T13:25:50.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'lost.updateserver1.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555f-1c58-4114-bf95-4404950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:51.000Z",
|
|
"modified": "2016-05-02T13:25:51.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'lu.ige.es']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727555f-6fb4-4661-9ec2-47b1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:51.000Z",
|
|
"modified": "2016-05-02T13:25:51.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'mand.pwnz.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275560-2118-4f45-b2ff-479e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:52.000Z",
|
|
"modified": "2016-05-02T13:25:52.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'myblog2000.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275560-1b30-4572-b7c7-498e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:52.000Z",
|
|
"modified": "2016-05-02T13:25:52.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'ns2.myblog2000.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275560-bbc0-46bc-acf8-4105950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:52.000Z",
|
|
"modified": "2016-05-02T13:25:52.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'nus.soon.it']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275561-9114-4583-a777-4258950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:53.000Z",
|
|
"modified": "2016-05-02T13:25:53.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'safehostonline.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275561-787c-421f-b2d2-4763950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:53.000Z",
|
|
"modified": "2016-05-02T13:25:53.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'secup.soon.it']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275562-f134-45a0-911c-4974950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:54.000Z",
|
|
"modified": "2016-05-02T13:25:54.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'short-name.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275562-a410-42e4-822e-4061950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:54.000Z",
|
|
"modified": "2016-05-02T13:25:54.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275562-ca8c-45ce-8b69-431a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:54.000Z",
|
|
"modified": "2016-05-02T13:25:54.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'update.info.gf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275563-53e4-48c7-91e8-48b2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:55.000Z",
|
|
"modified": "2016-05-02T13:25:55.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'updatebox4.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275563-7320-4228-981c-4bf8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:55.000Z",
|
|
"modified": "2016-05-02T13:25:55.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'updateserver1.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275564-dff0-47d2-b610-46e9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:56.000Z",
|
|
"modified": "2016-05-02T13:25:56.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'updateserver3.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275564-1244-41ef-bfa3-4d13950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:56.000Z",
|
|
"modified": "2016-05-02T13:25:56.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us1.short-name.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275564-5ecc-4773-ae8a-4a52950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:56.000Z",
|
|
"modified": "2016-05-02T13:25:56.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us12.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275565-b770-49df-8e66-4b6b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:57.000Z",
|
|
"modified": "2016-05-02T13:25:57.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us13.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275565-3bc8-4808-b9ec-4744950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:57.000Z",
|
|
"modified": "2016-05-02T13:25:57.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us15.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275566-c51c-43b7-ae13-4064950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:58.000Z",
|
|
"modified": "2016-05-02T13:25:58.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us16.short-url20.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275566-63c0-42b4-b72a-47f6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:58.000Z",
|
|
"modified": "2016-05-02T13:25:58.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'us1s2.strangled.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275566-ecb4-47d0-90b9-42d7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:58.000Z",
|
|
"modified": "2016-05-02T13:25:58.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'wep.archvisio.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275567-0d64-4665-81a8-446d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:59.000Z",
|
|
"modified": "2016-05-02T13:25:59.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'wep.soon.it']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275567-1094-4817-9771-4f2a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:25:59.000Z",
|
|
"modified": "2016-05-02T13:25:59.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'wpstat.mine.bz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:25:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275568-c1f8-4fca-8712-45f9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:26:00.000Z",
|
|
"modified": "2016-05-02T13:26:00.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'wpstat.strangled.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:26:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275568-f460-4f8e-acaa-4e5a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:26:00.000Z",
|
|
"modified": "2016-05-02T13:26:00.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'www.fastupdate.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:26:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275568-a544-4e26-92fc-42d8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:26:00.000Z",
|
|
"modified": "2016-05-02T13:26:00.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'www.updateserver1.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:26:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275569-037c-4640-91f8-44bb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:26:01.000Z",
|
|
"modified": "2016-05-02T13:26:01.000Z",
|
|
"description": "Observed Infy C2 Domains",
|
|
"pattern": "[domain-name:value = 'youripinfo.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:26:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566e-1b6c-4151-86c7-4906950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:22.000Z",
|
|
"modified": "2016-05-02T13:30:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '005b33c20c8d89453f6f0858b41881f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566e-7ffc-4d64-b157-4344950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:22.000Z",
|
|
"modified": "2016-05-02T13:30:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '008a6d9e67f18a2ad1f4bb10a354a8be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566e-3e94-466a-8ef6-4679950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:22.000Z",
|
|
"modified": "2016-05-02T13:30:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0096c70453cd7110453b6609a950ce18']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566f-b528-47d8-ab9c-4fd9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:23.000Z",
|
|
"modified": "2016-05-02T13:30:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '01cc9c914ece9d6c88b4a2c7fb7ec24e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566f-5d74-4d32-8401-4367950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:23.000Z",
|
|
"modified": "2016-05-02T13:30:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0213afd3721928daa1fd4192c9edaf16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727566f-75cc-42b0-88ba-4bd3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:23.000Z",
|
|
"modified": "2016-05-02T13:30:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '022672d91bc3039bc3935c7161389bb3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275670-f324-4e76-9e19-40ec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:24.000Z",
|
|
"modified": "2016-05-02T13:30:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '038bd4efdecd4381c2b51ac101816747']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275670-b254-4469-9c18-4715950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:24.000Z",
|
|
"modified": "2016-05-02T13:30:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '05e79fe215b04d78f1008960f10be60d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275670-e408-4e60-a09c-4c37950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:24.000Z",
|
|
"modified": "2016-05-02T13:30:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '06a3cdf1f52bbbbc3fbddbd80366c459']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275671-1e80-43b5-92e1-4756950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:25.000Z",
|
|
"modified": "2016-05-02T13:30:25.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '09f8655f862f0074b6648df4dd2bcc8b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275671-974c-436d-a611-47aa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:25.000Z",
|
|
"modified": "2016-05-02T13:30:25.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0a07888d4ad0ba8c83e8cbe555ba7810']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275672-7198-4ecd-bbaa-43d0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:26.000Z",
|
|
"modified": "2016-05-02T13:30:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0b3ee491ac8a3a4f67a3981bbcd773a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275672-6248-47d9-acfb-4288950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:26.000Z",
|
|
"modified": "2016-05-02T13:30:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0bd433d843a83c5fa816329dd9444c8e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275672-003c-468b-a7d9-49f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:26.000Z",
|
|
"modified": "2016-05-02T13:30:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0bec1d0a2487653801ed24422a89433b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275673-cdb8-4301-8355-4688950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:27.000Z",
|
|
"modified": "2016-05-02T13:30:27.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0c4794ee8211d030fbaf72ffd028b302']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275673-60b0-47fc-87d3-4fe3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:27.000Z",
|
|
"modified": "2016-05-02T13:30:27.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0c8c1e8b3ccab7b01f7a9246a994ee49']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275674-247c-4a20-91fb-4faa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:28.000Z",
|
|
"modified": "2016-05-02T13:30:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0cdb7ea63cd53ac9a99a9e8c6b7d98dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275674-e0b8-4493-94b5-423d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:28.000Z",
|
|
"modified": "2016-05-02T13:30:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '0d7909ab4f933b56f7727726c2b1aa78']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275674-ff24-40a8-8163-421a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:28.000Z",
|
|
"modified": "2016-05-02T13:30:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1018960f13469a54e48eb4468b119d24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275675-d040-464f-a832-41da950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:29.000Z",
|
|
"modified": "2016-05-02T13:30:29.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '109f613a3db75b78a8f2fc4f4d9c1aa3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275675-11d4-4c49-a0a7-4506950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:29.000Z",
|
|
"modified": "2016-05-02T13:30:29.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '10edd365e7353200c88c4fa2595a1c57']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275676-b778-4ab2-adf0-4b90950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:30.000Z",
|
|
"modified": "2016-05-02T13:30:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '10eee810f70b9aee5d2784b79539f880']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275676-d734-43b4-af36-4f3d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:30.000Z",
|
|
"modified": "2016-05-02T13:30:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '123506172c5d84d2c2d046edd66a57c0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275676-ce2c-46ff-a68b-48e8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:30.000Z",
|
|
"modified": "2016-05-02T13:30:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '12973584deae59421ed99e3adde993ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275677-6820-4bbb-80ce-41c5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:31.000Z",
|
|
"modified": "2016-05-02T13:30:31.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '12b6ce12e581aca530324bcd256de512']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275677-0834-4995-b809-47f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:31.000Z",
|
|
"modified": "2016-05-02T13:30:31.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '12d2cab3480c706f956da4a22c15ddb3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275678-1d1c-4d35-b51d-422b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:32.000Z",
|
|
"modified": "2016-05-02T13:30:32.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '13eb94e02912da06072246789aa1a8a8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275678-ad58-4bf7-8b03-4051950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:32.000Z",
|
|
"modified": "2016-05-02T13:30:32.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '16089210258939642c427188e70b3c2b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275678-7528-4bcf-b7da-45f2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:32.000Z",
|
|
"modified": "2016-05-02T13:30:32.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '17234fa07e77ddb2a05f221e6aa9d335']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275679-67dc-49ef-8018-459c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:33.000Z",
|
|
"modified": "2016-05-02T13:30:33.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '17e0b1e735f43bd15662325f37ad3816']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275679-6d48-46d6-bb4d-4fd3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:33.000Z",
|
|
"modified": "2016-05-02T13:30:33.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1831809c397b0c285146df1335efbf5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567a-ba64-4317-8031-4e0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:34.000Z",
|
|
"modified": "2016-05-02T13:30:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '18713529ff40b366b162c276333b62ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567a-b60c-4e21-8c45-43c3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:34.000Z",
|
|
"modified": "2016-05-02T13:30:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1906dc3bc8d5086af55ad7902a550d45']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567a-cb3c-4d8b-8bef-4874950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:34.000Z",
|
|
"modified": "2016-05-02T13:30:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '190d4104d774527106fa28d5df4e3fd2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567b-ad34-4ad1-80c8-49b2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:35.000Z",
|
|
"modified": "2016-05-02T13:30:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1955f324552812e3fc8f4513cc058674']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567b-c86c-464c-8d2c-4cc4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:35.000Z",
|
|
"modified": "2016-05-02T13:30:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1a8c12cb5a07aae016d33015f589bfb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567b-204c-442f-9538-46c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:35.000Z",
|
|
"modified": "2016-05-02T13:30:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1a918a850892c2ca5480702c64c3454c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567c-7b94-42e5-8a56-42cb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:36.000Z",
|
|
"modified": "2016-05-02T13:30:36.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1ba3363da3130cc41ca152b4a8302809']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567c-ef04-46ca-a64b-41d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:36.000Z",
|
|
"modified": "2016-05-02T13:30:36.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1c9c491dc0e20ca1a46677f9b5552ff3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567d-16b0-4d72-8926-4e16950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:37.000Z",
|
|
"modified": "2016-05-02T13:30:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '1f6886dd68f7d1e02f6de08d43432487']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567d-2324-410c-a592-4756950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:37.000Z",
|
|
"modified": "2016-05-02T13:30:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '218f5cef2385ad8cf8dc60165ec63250']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567d-c20c-4819-8ea9-4813950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:37.000Z",
|
|
"modified": "2016-05-02T13:30:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '23326a8d4a09f74d033e46e1dc6d0e16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567e-2ed4-42ff-814f-48da950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:38.000Z",
|
|
"modified": "2016-05-02T13:30:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2409f03128690bc063aa6b8b160f6f35']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567e-6744-444e-956c-46af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:38.000Z",
|
|
"modified": "2016-05-02T13:30:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2417fb8f148afc6daad2dddce19b5e7d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567e-7584-42e4-919b-4caf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:38.000Z",
|
|
"modified": "2016-05-02T13:30:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '25fee0f3a3296a624db0dff85fbddb79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567f-3600-4500-bfb9-4695950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:39.000Z",
|
|
"modified": "2016-05-02T13:30:39.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '260687b5a29d9a8947d514acae695ad4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727567f-b230-45a4-9280-41ee950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:39.000Z",
|
|
"modified": "2016-05-02T13:30:39.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '29cc209a96cea4fe241373c784fed35c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275680-8edc-432a-b6d9-4919950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:40.000Z",
|
|
"modified": "2016-05-02T13:30:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2a1294ac176e9949362f088fa45df777']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275680-7cf4-4d24-bc0f-4c76950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:40.000Z",
|
|
"modified": "2016-05-02T13:30:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2a7bea7f4391327c7d3f9bae58e40c03']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275680-fba4-484d-8067-44c8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:40.000Z",
|
|
"modified": "2016-05-02T13:30:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2a817c1d6bad99430c9eace0a6008a75']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275681-6a5c-421e-80f3-46d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:41.000Z",
|
|
"modified": "2016-05-02T13:30:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2b2ef3be4cdb0c7046fc19965f5f37ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275681-443c-41f3-861c-4878950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:41.000Z",
|
|
"modified": "2016-05-02T13:30:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2c2a582705477443060d3277fb85e059']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275681-1710-48b2-8737-432c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:41.000Z",
|
|
"modified": "2016-05-02T13:30:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2e4756bbc331661137b928e4a77e8c26']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275682-b2f8-4536-87f5-40a8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:42.000Z",
|
|
"modified": "2016-05-02T13:30:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '2fce0cc603d4a8b23c86d47bf55ad570']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275682-2e74-4728-8688-4e8a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:42.000Z",
|
|
"modified": "2016-05-02T13:30:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '303b7700fb36ec54c20a0e2bef38a9cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275682-8d80-4e69-a5d5-4ed2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:42.000Z",
|
|
"modified": "2016-05-02T13:30:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '31e100ec9c9cf0ecef328a79b60a6455']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275682-7394-4bf6-9eb2-4eb5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:42.000Z",
|
|
"modified": "2016-05-02T13:30:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '32ecd6aea9d252bfd1c19efcb614ed9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275683-a21c-4dc2-8d55-4565950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:43.000Z",
|
|
"modified": "2016-05-02T13:30:43.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '35d0338f6d82f97442c1da865b6bc644']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275683-6764-43f5-a140-4383950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:43.000Z",
|
|
"modified": "2016-05-02T13:30:43.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '3b2336e09cfea5e2c1c430ec371dcb0b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275684-b850-44d9-bcf9-4d84950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:44.000Z",
|
|
"modified": "2016-05-02T13:30:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '3ba1849c777a97c73781d22bedde4446']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275684-3088-4a71-8efb-4786950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:44.000Z",
|
|
"modified": "2016-05-02T13:30:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '3ecaacd6ccdcbb0fe149f68db964a308']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275684-8850-4b84-ba1e-46c2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:44.000Z",
|
|
"modified": "2016-05-02T13:30:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '3f679d89e54f89a008bdd25d64cd46ed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275685-3c30-4bc7-aef5-49ea950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:45.000Z",
|
|
"modified": "2016-05-02T13:30:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '403bfd88f3d24710993c9b1aaaab7ae2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275685-94ec-458a-a6f0-4b3f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:45.000Z",
|
|
"modified": "2016-05-02T13:30:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '40e3a7d66505b6652ece0b877b40f35b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275685-7668-48c3-8f0e-4c52950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:45.000Z",
|
|
"modified": "2016-05-02T13:30:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '426a4471537a4d926a5b1f1119294787']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275685-1288-4f4c-80b5-45c4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:45.000Z",
|
|
"modified": "2016-05-02T13:30:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '43816893d27145e37cd3dbad22f29377']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275686-0fc4-48e9-a1fb-4446950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:46.000Z",
|
|
"modified": "2016-05-02T13:30:46.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '4462402c80795fec584b0fef4b30ecf3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275686-b62c-4e76-a528-4dc8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:46.000Z",
|
|
"modified": "2016-05-02T13:30:46.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '44e6101ee0d2a267dd5a71de9ff3d49b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275687-6904-43f8-8048-4c11950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:47.000Z",
|
|
"modified": "2016-05-02T13:30:47.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '47fcbd8058ec08f2da3ff184b4de0d79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275687-b77c-47af-92f6-4eb8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:47.000Z",
|
|
"modified": "2016-05-02T13:30:47.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '48fe8cd9e6de8d5fae5f34785d4ac6d5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275687-10c4-4254-bd3d-4a01950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:47.000Z",
|
|
"modified": "2016-05-02T13:30:47.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '4ad5cc8dcf847be7c8787c02f06a5427']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275687-2654-4278-84ce-44f1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:47.000Z",
|
|
"modified": "2016-05-02T13:30:47.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '4b6e12709a2e708e682296d00383e0d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275688-067c-4ebc-b72a-4388950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:48.000Z",
|
|
"modified": "2016-05-02T13:30:48.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '4e768baed3dc75c224c6eb1671654e98']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275688-cc30-479c-8fba-492c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:48.000Z",
|
|
"modified": "2016-05-02T13:30:48.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '513b77a133f8d4f7c1e2a7ed150cd97c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275688-b41c-4e15-a98b-4300950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:48.000Z",
|
|
"modified": "2016-05-02T13:30:48.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5252efdc70dcbb53713454099fd10277']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275689-0ff8-4047-81e0-4442950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:49.000Z",
|
|
"modified": "2016-05-02T13:30:49.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5598951815d4c39a9ad76188354666b5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275689-99c0-4562-bbd9-44d6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:49.000Z",
|
|
"modified": "2016-05-02T13:30:49.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '55d11e996ef37a99ddbedc9847dcc55b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568a-44cc-4f8f-9ebe-4dc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:50.000Z",
|
|
"modified": "2016-05-02T13:30:50.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '578677cc3e31dab487280dc50c90ac4c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568a-1034-4746-8e6c-4d06950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:50.000Z",
|
|
"modified": "2016-05-02T13:30:50.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5ab14c2503fca14ca416d3bc0ae62a8d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568a-e608-4bfd-be77-4571950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:50.000Z",
|
|
"modified": "2016-05-02T13:30:50.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5acba38d707f3d5015e64550c7689c05']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568b-239c-4b71-9d26-4394950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:51.000Z",
|
|
"modified": "2016-05-02T13:30:51.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5cccc95e3795c347d1609c62f3127da5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568b-eaf8-4e01-9cb9-4351950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:51.000Z",
|
|
"modified": "2016-05-02T13:30:51.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5dc7347bafd0874be2430b71953738e6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568b-84ec-46d2-a027-43a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:51.000Z",
|
|
"modified": "2016-05-02T13:30:51.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '5e5709043f1113d87b309e91b3cfae7e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568c-e30c-4c08-b36f-4d0d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:52.000Z",
|
|
"modified": "2016-05-02T13:30:52.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6588d0b81d0491d7c1cd7ef88c2c1494']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568c-7398-497c-8bc8-4d57950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:52.000Z",
|
|
"modified": "2016-05-02T13:30:52.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6852787a390630ba38920c2998e60151']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568c-51ac-4a59-9ee7-4884950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:52.000Z",
|
|
"modified": "2016-05-02T13:30:52.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '69b075a20f94532f8f82100a418de1f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568d-1b08-4991-92e5-4f33950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:53.000Z",
|
|
"modified": "2016-05-02T13:30:53.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6a963c5f650d6e3d56062eb0789e4a8b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568d-a498-48cb-92fd-4ee2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:53.000Z",
|
|
"modified": "2016-05-02T13:30:53.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6bc1aea97e7b420b0993eff794ed2aeb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568d-1f8c-4ecb-b501-4e08950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:53.000Z",
|
|
"modified": "2016-05-02T13:30:53.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6e4e52cf69e37d2d540a431f23d7015a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568e-8290-4c9f-9875-4c21950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:54.000Z",
|
|
"modified": "2016-05-02T13:30:54.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6e6bc3d845aa23c2fa38f361c5b93814']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568e-4994-4963-a567-4d47950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:54.000Z",
|
|
"modified": "2016-05-02T13:30:54.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '6f4d9b956180e74b17fe3c29063f5691']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568f-ef54-4fbc-b40c-4ad3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:55.000Z",
|
|
"modified": "2016-05-02T13:30:55.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '70c447c9e71c8e6bd336670119e8df1b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568f-d684-44a4-8646-4732950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:55.000Z",
|
|
"modified": "2016-05-02T13:30:55.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '72207024854e6c8e83996f3baa659e6b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727568f-7130-45ff-8570-40f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:55.000Z",
|
|
"modified": "2016-05-02T13:30:55.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '763259b197082bd81233aed55749275f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275690-f3ec-4dcb-95c5-4a09950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:56.000Z",
|
|
"modified": "2016-05-02T13:30:56.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '771080b2675b1af82e59d34450cfb6b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275690-f9a0-450e-8b2f-48f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:56.000Z",
|
|
"modified": "2016-05-02T13:30:56.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '79a07963b57d0bbae1625cf582d2a55a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275690-9a1c-4b78-944f-4c7d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:56.000Z",
|
|
"modified": "2016-05-02T13:30:56.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7a64fef96e69f58bd52abdff97cc95a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275691-91cc-4a15-93d4-4c9d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:57.000Z",
|
|
"modified": "2016-05-02T13:30:57.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7a6e9a6e87e1e43ad188f18ae42f470f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275691-5ee4-4db1-be1c-46ba950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:57.000Z",
|
|
"modified": "2016-05-02T13:30:57.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7c8e950c3adcbbcca2c8b54614566ec7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275692-9480-4804-8f57-4106950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:58.000Z",
|
|
"modified": "2016-05-02T13:30:58.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7cf09004bfb2833253d0d9faaadbbc2c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275692-4d98-4b6d-a28b-4b55950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:58.000Z",
|
|
"modified": "2016-05-02T13:30:58.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7e9552cbe1afdb03cedff301f2080f9c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275692-ca10-482f-9228-42d0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:58.000Z",
|
|
"modified": "2016-05-02T13:30:58.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '7eab33c7b51c62b9396a75630f29090b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275693-a34c-4b6f-889c-400b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:59.000Z",
|
|
"modified": "2016-05-02T13:30:59.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '80b1f897b670c27a30c9eca9e3d7d604']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275693-b6d0-4891-a109-4b14950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:59.000Z",
|
|
"modified": "2016-05-02T13:30:59.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '80ca98965c7c3fa89fd85f8823544ff4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275693-06f0-489c-8fb8-4870950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:30:59.000Z",
|
|
"modified": "2016-05-02T13:30:59.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '8448f958a6acdb606f6f1242a963f845']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:30:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275694-7490-4a4c-8f39-43c8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:00.000Z",
|
|
"modified": "2016-05-02T13:31:00.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '85f37501477284f032c3d3981c5a8a75']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275694-6048-4a4b-aa12-43f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:00.000Z",
|
|
"modified": "2016-05-02T13:31:00.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '8a1f29d4fea917b8548cb9a936126daa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275694-298c-4195-9f21-4def950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:00.000Z",
|
|
"modified": "2016-05-02T13:31:00.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '8ae6139ba59a6d94d82a97464f185c16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275695-e3ac-4cd8-9715-45d3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:01.000Z",
|
|
"modified": "2016-05-02T13:31:01.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '8c7ec022ef9b6e8e30b6761da0975aea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275695-f168-493c-9f53-4d2f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:01.000Z",
|
|
"modified": "2016-05-02T13:31:01.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '8d2ab6bf1ded4e1f588385865bc9574a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275695-b228-489e-8d55-4f4c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:01.000Z",
|
|
"modified": "2016-05-02T13:31:01.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '91b7beb61cb7f7f7b42429d389477063']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275696-0af8-43a9-b681-4766950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:02.000Z",
|
|
"modified": "2016-05-02T13:31:02.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '926c851ae6bea03f97cb3c2f17c6204d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275696-1ab4-43d4-ac71-4af3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:02.000Z",
|
|
"modified": "2016-05-02T13:31:02.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '94d9590903fd123329de054f6988a17e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275697-e37c-4809-b707-471c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:03.000Z",
|
|
"modified": "2016-05-02T13:31:03.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '95f0b3a442f0f14746d367e4273c787b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275697-3ec8-43c1-8b14-42aa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:03.000Z",
|
|
"modified": "2016-05-02T13:31:03.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9942a1f59cd48b27931977c400328a68']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275697-f6bc-4a51-91bb-4f8c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:03.000Z",
|
|
"modified": "2016-05-02T13:31:03.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9955f33e1f605bfe29b91b9efe242fb0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275698-71dc-4e34-a12d-4d5c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:04.000Z",
|
|
"modified": "2016-05-02T13:31:04.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '99ceb97edf9c8e6850f858ca4319c885']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275698-8ffc-4c3e-9615-4821950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:04.000Z",
|
|
"modified": "2016-05-02T13:31:04.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '99f4fdbbed01c6cccd014350d14b5817']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275698-02e4-4cf8-b1ac-4bdb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:04.000Z",
|
|
"modified": "2016-05-02T13:31:04.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9a78686ffb97a9942867785c7df54811']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275699-9030-4070-9fdc-4c09950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:05.000Z",
|
|
"modified": "2016-05-02T13:31:05.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9b9011532583aa3d4c626e932cad26ac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275699-bcbc-42a8-a919-4af5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:05.000Z",
|
|
"modified": "2016-05-02T13:31:05.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9c487d0d0a17ff44f5c8f5bd5b7687cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275699-3c88-4a40-bbe1-4995950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:05.000Z",
|
|
"modified": "2016-05-02T13:31:05.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9d1109ab2e0c382cc2839dffb0a41aa8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569a-65b4-47ad-aa57-456d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:06.000Z",
|
|
"modified": "2016-05-02T13:31:06.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9d56d42b3d9a4f025926eeb54592c017']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569a-1b58-4dc1-bd62-422d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:06.000Z",
|
|
"modified": "2016-05-02T13:31:06.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9d80a85f363ac47612432d68959a7de5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569a-a9bc-43cc-b8e8-41bd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:06.000Z",
|
|
"modified": "2016-05-02T13:31:06.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9f6f3cad4657ee521b4c9a6099ebd3f5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569b-5ee0-43f8-971f-4f42950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:07.000Z",
|
|
"modified": "2016-05-02T13:31:07.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = '9f926c3ce839f5c2cce936cf7424da0c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569b-5648-4422-ab02-4a22950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:07.000Z",
|
|
"modified": "2016-05-02T13:31:07.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'a0ce7cb65688e16fe7cecbb5ee75ad16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569b-8de8-4081-89bd-4e57950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:07.000Z",
|
|
"modified": "2016-05-02T13:31:07.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'a161fc64a9c659264d0a897201a1b51d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569c-cd70-4f44-b51a-4716950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:08.000Z",
|
|
"modified": "2016-05-02T13:31:08.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'a1ae4368352542f5f81ac072c3c00f11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569c-b970-41ed-b858-4b13950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:08.000Z",
|
|
"modified": "2016-05-02T13:31:08.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'a3b576495b790f43327cf38a7a28d1a6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569c-b350-4875-861c-4e77950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:08.000Z",
|
|
"modified": "2016-05-02T13:31:08.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'aa220955c78d5c4077249555d958dcb0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569d-5008-486c-805b-4736950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:09.000Z",
|
|
"modified": "2016-05-02T13:31:09.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'aa4cfb13a699eafb60e4ea0fb602f144']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569d-9600-4216-9e5d-4215950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:09.000Z",
|
|
"modified": "2016-05-02T13:31:09.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ac8d334c5f519d5d146e7949036be964']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569d-c7b8-4e6f-9689-4762950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:09.000Z",
|
|
"modified": "2016-05-02T13:31:09.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ad24c8c54e467d235faaa85f3a98a55a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569e-4e84-4704-9d9a-4a85950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:10.000Z",
|
|
"modified": "2016-05-02T13:31:10.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b07d49c1c9f6958b7a96b3c87e039cf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569e-8f4c-4312-83e3-4425950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:10.000Z",
|
|
"modified": "2016-05-02T13:31:10.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b15b59e56988d3a815a1c77b52689bf0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569f-51b0-4fb4-b75a-47c3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:11.000Z",
|
|
"modified": "2016-05-02T13:31:11.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b2ef1ef6c9815385a0526de99a3a382b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569f-983c-4a6f-ae9f-4b14950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:11.000Z",
|
|
"modified": "2016-05-02T13:31:11.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b3cb5132f9f7f3225952e461d5a813e7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727569f-660c-4ada-86cd-4f1f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:11.000Z",
|
|
"modified": "2016-05-02T13:31:11.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b43b56a5167d0c73c324c68e8e55253a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a0-25fc-4f74-a811-439b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:12.000Z",
|
|
"modified": "2016-05-02T13:31:12.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b4b1d37845a5448ba394c751fc481d63']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a0-55bc-42e0-8d64-4ef2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:12.000Z",
|
|
"modified": "2016-05-02T13:31:12.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b74c6fbb8c0812797c726395b3bd812e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a0-1254-4116-b27a-49bc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:12.000Z",
|
|
"modified": "2016-05-02T13:31:12.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b985a36d00033365bfd9b39cc95242b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a1-364c-493c-9277-43d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:13.000Z",
|
|
"modified": "2016-05-02T13:31:13.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'b9c55a7acecc3509b057b34e0a749c88']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a1-d0ac-4aa6-a92c-4373950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:13.000Z",
|
|
"modified": "2016-05-02T13:31:13.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ba5e2404e99f874eae7ba4a4179a5a0d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a1-2808-4d02-98c0-44a4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:13.000Z",
|
|
"modified": "2016-05-02T13:31:13.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'baf685816ef9f71b85f2fd15df63be53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a2-4ca0-4cb3-9662-45c8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:14.000Z",
|
|
"modified": "2016-05-02T13:31:14.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'bb8bff333eb1fb47b1b020b5696e00f3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a2-6424-472e-afcf-413e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:14.000Z",
|
|
"modified": "2016-05-02T13:31:14.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'bc8c1f72d0813c281c9a1e4a3fb10f5e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a3-8dc0-48c3-ad7d-4c1e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:15.000Z",
|
|
"modified": "2016-05-02T13:31:15.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'bd3c5fb34f164df13eeaa75aae16eff4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a3-9920-490a-aba6-4ce7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:15.000Z",
|
|
"modified": "2016-05-02T13:31:15.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'bd5c838a2f00dd5fd9ab9ebe0cb2528e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a3-395c-4bef-8534-476a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:15.000Z",
|
|
"modified": "2016-05-02T13:31:15.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'beef98ff03885a41ca0d70dcbe738bf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a4-ca98-41e0-932e-47fb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:16.000Z",
|
|
"modified": "2016-05-02T13:31:16.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c1a7bd517cfc88c17176a65e82a5bea9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a4-db44-43d9-86f4-4caa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:16.000Z",
|
|
"modified": "2016-05-02T13:31:16.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c30614492d31e60511fb8b28fea653ef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a4-3d30-4af2-9021-4ed4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:16.000Z",
|
|
"modified": "2016-05-02T13:31:16.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c4c1c7722cfdf5ecc66b387dd4a37405']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a5-a62c-4da0-a0cd-489e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:17.000Z",
|
|
"modified": "2016-05-02T13:31:17.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c4d8b12a70cf01df681712f1a2ddf0fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a5-8c10-4df3-b0de-4ad0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:17.000Z",
|
|
"modified": "2016-05-02T13:31:17.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c5eeae78cb820186f5f1acad6f1039af']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a5-cd94-44fd-83e5-4ce3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:17.000Z",
|
|
"modified": "2016-05-02T13:31:17.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c60abc691aeb768b73509886bec89e6d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a6-4ba4-4873-b43f-4b8b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:18.000Z",
|
|
"modified": "2016-05-02T13:31:18.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'c6f27fe0ba7a877fecdc6227454d052f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a6-8358-4581-b75b-4cf2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:18.000Z",
|
|
"modified": "2016-05-02T13:31:18.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'cb635b1ff7443252cf3686a5a8c40efa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a6-5b84-443f-8e90-499c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:18.000Z",
|
|
"modified": "2016-05-02T13:31:18.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'cc6fd51232b35cff84b6c3d9bfc6be4c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a7-af74-49c9-a56e-40f9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:19.000Z",
|
|
"modified": "2016-05-02T13:31:19.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'cdcb1bf7a92c206be4f2f8493424f97b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a7-9c5c-4449-81fb-4a07950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:19.000Z",
|
|
"modified": "2016-05-02T13:31:19.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'cf1168f3e17150def9f5024055184fb6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a7-0d70-4518-a8c2-4586950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:19.000Z",
|
|
"modified": "2016-05-02T13:31:19.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd101106f8551a38eb9a11fc1da903a67']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a8-fa04-4934-af63-4121950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:20.000Z",
|
|
"modified": "2016-05-02T13:31:20.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd1a25ebf70a88fd76c3a7501733f1e24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a8-dd94-4a93-afd2-4157950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:20.000Z",
|
|
"modified": "2016-05-02T13:31:20.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd2bad8e2f9c5c813c1ab4c76ba9f9ab6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a8-118c-45a2-b590-4df9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:20.000Z",
|
|
"modified": "2016-05-02T13:31:20.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd718e6a861fc74cd47626fdb5dd8559a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a9-29a4-4077-8d07-4763950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:21.000Z",
|
|
"modified": "2016-05-02T13:31:21.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd78149cd7ee8a37ced029d168ed776e9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a9-f57c-4fcf-a271-4b4f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:21.000Z",
|
|
"modified": "2016-05-02T13:31:21.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd78d5dcbab09d3f1276dd825d74a55be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756a9-e2f4-42da-bae1-4df7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:21.000Z",
|
|
"modified": "2016-05-02T13:31:21.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd89d3297c9c310e3cdc67f92d8585025']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756aa-3fc0-4b86-82a0-4b55950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:22.000Z",
|
|
"modified": "2016-05-02T13:31:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'd9da6c95fb6a5cbefb2fcac169c61b59']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756aa-a650-4f5b-8ea5-4822950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:22.000Z",
|
|
"modified": "2016-05-02T13:31:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'dbc1bed3a44619c834b6b22bba46b20c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756aa-9380-48c6-b47f-4f45950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:22.000Z",
|
|
"modified": "2016-05-02T13:31:22.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'dc7d20a327c20c75b9e2cd45adc5aee5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ab-79fc-4ae5-b2f9-4878950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:23.000Z",
|
|
"modified": "2016-05-02T13:31:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'dcce201e25afac6f0d8ac5bf1b2ebcaf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ab-9f38-4a9b-b1e7-4827950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:23.000Z",
|
|
"modified": "2016-05-02T13:31:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ded4f175d84044c10fe1d3a629918f67']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ab-658c-4faf-a555-4249950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:23.000Z",
|
|
"modified": "2016-05-02T13:31:23.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e019892328a1dc5a952d8fec4280863b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ac-c94c-4979-bcee-4db5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:24.000Z",
|
|
"modified": "2016-05-02T13:31:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e2f6adfa24b9750746cdae6ee15b3b56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ac-d5e0-4f2e-82d1-429f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:24.000Z",
|
|
"modified": "2016-05-02T13:31:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e3ecde087e1fc5a33cc04ab076e3d373']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ac-f804-4279-9c94-4a73950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:24.000Z",
|
|
"modified": "2016-05-02T13:31:24.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e64ceb2c9b2c8ba8709a139f6ba27ff6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ad-b398-4c30-a2f7-414d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:25.000Z",
|
|
"modified": "2016-05-02T13:31:25.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e6a5b2f98260f707d237bbc0a9f451c8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ad-a8a0-42c0-822a-4c8a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:25.000Z",
|
|
"modified": "2016-05-02T13:31:25.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e88599c90a6884cd8341975e60ab6db9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ad-b3e0-4b3a-99ab-4eb7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:25.000Z",
|
|
"modified": "2016-05-02T13:31:25.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e9117eda1f943c53a02942d2e7039fb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ae-b134-488e-901a-41b3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:26.000Z",
|
|
"modified": "2016-05-02T13:31:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e99dd650695b19b7eb57868ee4251052']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ae-5794-410b-9aa8-4fb5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:26.000Z",
|
|
"modified": "2016-05-02T13:31:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'e9d468c72e9ffa3962d09abd0c586772']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ae-7ca0-4632-bfa7-40a5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:26.000Z",
|
|
"modified": "2016-05-02T13:31:26.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'eae5749af7bcfab51342ec3947264587']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756af-7f58-408d-83d7-445b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:27.000Z",
|
|
"modified": "2016-05-02T13:31:27.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'eb7e6a84f018692ad6a1a58f530c14e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756af-07b8-455d-b4c9-4407950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:27.000Z",
|
|
"modified": "2016-05-02T13:31:27.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'eccc160b9e5a2caf4437896dd04bf6f6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756af-f4f4-40ac-a4f9-44b4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:27.000Z",
|
|
"modified": "2016-05-02T13:31:27.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ed15da7cdc85f8e7e2527646944c7010']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b0-e5c4-4564-b92b-4921950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:28.000Z",
|
|
"modified": "2016-05-02T13:31:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ed82c1d1a09f1382a9bb279c06eccd0f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b0-502c-4469-a52a-4777950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:28.000Z",
|
|
"modified": "2016-05-02T13:31:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'ef389dde0e84fb495e9b59c61293f525']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b0-1bd0-453c-8fdb-472a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:28.000Z",
|
|
"modified": "2016-05-02T13:31:28.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'efbd383d5a5516445820b013d8f8e207']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b1-8ebc-486e-a0bd-4837950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:29.000Z",
|
|
"modified": "2016-05-02T13:31:29.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f1139f9162bb2e18d2db4793745aa139']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b1-27c4-456f-975a-40c4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:29.000Z",
|
|
"modified": "2016-05-02T13:31:29.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f15f75a3f633c334087be5005e5d60ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b1-cea8-4fdd-8542-4c66950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:29.000Z",
|
|
"modified": "2016-05-02T13:31:29.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f1c06830c806dc0aaa6c9283bdc1777d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b2-03ec-4747-affd-4a4f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:30.000Z",
|
|
"modified": "2016-05-02T13:31:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f37bbbf212ad212dbcbf45e771226f70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b2-bf98-4d91-b5cb-4292950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:30.000Z",
|
|
"modified": "2016-05-02T13:31:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f83ec55fe1c92f95656350deb44e804a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b2-0478-4e0c-8989-4a37950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:30.000Z",
|
|
"modified": "2016-05-02T13:31:30.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'f8edf0879030e511bad759a9fe588a15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b3-4044-4cd7-9935-4474950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:31.000Z",
|
|
"modified": "2016-05-02T13:31:31.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'fa444d883acb09d2dd6e4d5ea056c514']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b3-8d00-46f5-96bb-42fa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:31.000Z",
|
|
"modified": "2016-05-02T13:31:31.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'fcb02cdd979b12a25befef990977072a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b3-13bc-46dd-887e-4564950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:31.000Z",
|
|
"modified": "2016-05-02T13:31:31.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'fcee2e1dd2188d28bd0530c46ca66ab4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b4-cd84-408d-9314-4055950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:32.000Z",
|
|
"modified": "2016-05-02T13:31:32.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.MD5 = 'fd33a6c08159d1f688fe927076c1e441']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b4-b0dc-47b9-a89a-4000950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:32.000Z",
|
|
"modified": "2016-05-02T13:31:32.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '00ccd3155a9c0de0072a4b31d62eb619b099726911ee9a9c8a50ed2a2c44ac80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b5-a138-4a08-a592-4962950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:33.000Z",
|
|
"modified": "2016-05-02T13:31:33.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '0598dd550b3854380a4afe915f61ad63ca807d3adf52f4548a49290fbbf7f1e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b5-916c-41bf-939d-4311950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:33.000Z",
|
|
"modified": "2016-05-02T13:31:33.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '084536508fe90416e7609481b3b09a6652d805db866791d3dfe2a9f2a076767f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b5-e648-4d5d-a30b-4ef6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:33.000Z",
|
|
"modified": "2016-05-02T13:31:33.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '14fb0d3dda2e183a114336a3e4fe6668a5979bfc716a82e62d059d046800137e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b6-a2d4-45df-9d73-4c13950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:34.000Z",
|
|
"modified": "2016-05-02T13:31:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '1acb2e942d0c73214155ced4f7f11b84c2f92a3988e6203b817a98ba91ebca2a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b6-5b94-487e-8a20-4132950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:34.000Z",
|
|
"modified": "2016-05-02T13:31:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '354dd026033764ece26f3248e1cbaa504bcd2c556794921498b3b083be42b437']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b6-0104-4c4e-8136-48ff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:34.000Z",
|
|
"modified": "2016-05-02T13:31:34.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '391953799e25a7d4df62381dc02f23f96f200688c3e21f7b732e39275b8e9f27']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b7-a1e8-4eb6-9d23-4a92950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:35.000Z",
|
|
"modified": "2016-05-02T13:31:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '4398d635849ba7c909d62c6cea76e7ae875fd0d998d6e606e7e343b4194857b7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b7-e6d4-4ab3-9482-4e85950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:35.000Z",
|
|
"modified": "2016-05-02T13:31:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '43bd06de8cfc34a98ed59b29a9499d934bfe5aeb541a87296e5b509dd4a50514']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b7-0438-4e57-a4d4-4a3a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:35.000Z",
|
|
"modified": "2016-05-02T13:31:35.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '45ce1e1efaeb44bc9ac7996aba4e866c0cd80bda1ffe25d46c0a3f6a4fc12f9d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b8-161c-4ced-b7d9-4dec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:36.000Z",
|
|
"modified": "2016-05-02T13:31:36.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '4d1ca3d0a71862d0fd828310aa2750509b4647de3506acf7a417b088091ad56b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b8-b1c4-4200-8209-4e29950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:36.000Z",
|
|
"modified": "2016-05-02T13:31:36.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '4e37491e7a25c029c5ec6738c57f9d08d551162baf276d9fb576b6849badaf5a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b8-329c-4b6b-aaa1-4e21950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:36.000Z",
|
|
"modified": "2016-05-02T13:31:36.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '597ed121a6e8bbee3a0cc9e167211a9ca165dd7e1f2d37c92ab97f189058861d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b9-02c8-43f8-8cef-494b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:37.000Z",
|
|
"modified": "2016-05-02T13:31:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '69b85527e2f67454c6397f7d099aa6327861d957e7fadc033ce09a395036caac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b9-f534-4997-8eea-4811950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:37.000Z",
|
|
"modified": "2016-05-02T13:31:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '763f8ab16e1640865e4aff4d7214f8ab1a3acc2400f68445191be5aaf4ed3215']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756b9-f778-4ab9-b28b-495e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:37.000Z",
|
|
"modified": "2016-05-02T13:31:37.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '7b0bc1442036e4fed232073ffcf13322d1d5fd9b60a2b8c0f14848d6e3c4a596']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ba-e028-4b14-b33e-4a61950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:38.000Z",
|
|
"modified": "2016-05-02T13:31:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '7bb0222d771c6a68d2f08772755b19af6d24f5ed144c6890b98eea19b24467d3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ba-bd04-43ff-8e1a-4546950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:38.000Z",
|
|
"modified": "2016-05-02T13:31:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '7e0a57d205d718740cd31fc55b3ab44411872c3da486d28466be31f0b1db68b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756ba-da68-4481-8101-4fc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:38.000Z",
|
|
"modified": "2016-05-02T13:31:38.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '7fd19d3fbe2ad1374a15ec128a9244ad817dbd81ce635516c7c4b4f1f1f6160e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bb-115c-43bf-944a-4199950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:39.000Z",
|
|
"modified": "2016-05-02T13:31:39.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '831a9f71391fb6a32b5ddcdbc62e6ac71c3a083c9d76d74911a620b2d7535783']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bb-c05c-4293-b7ca-4caa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:39.000Z",
|
|
"modified": "2016-05-02T13:31:39.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '8d8b9dcbc8c54316ac0cc3fb69058f75449ff60ffe62023f236201011920f91e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bb-ae30-4ca8-85b9-4940950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:39.000Z",
|
|
"modified": "2016-05-02T13:31:39.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '9370b0cd2a4d6affa4ab9a575ff9349b68c85b0b0dca3bfc08a0f8f8a66875f5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bc-e110-4510-a9df-46b0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:40.000Z",
|
|
"modified": "2016-05-02T13:31:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '93eb61afd4411ea9c867d11a46a410d84620ef0a57ace2f73882dae5f48572c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bc-3830-420e-93f5-4888950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:40.000Z",
|
|
"modified": "2016-05-02T13:31:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '942a23901f2f23f07ddac1384995b9e5fee73b649aef2dc6fb934230c010160c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bc-09b0-47ef-9331-4c51950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:40.000Z",
|
|
"modified": "2016-05-02T13:31:40.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '98dddf6797f1a64ba94663169355e32bf8a17e84f368fecc2300413e62a6de2b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bd-93c8-4047-91bd-4b1d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:41.000Z",
|
|
"modified": "2016-05-02T13:31:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '9a1bacaeec8c625bec6116743ba1427b34c493351e3c31e89d3121bb379ceae6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bd-9dac-4c91-81cf-45cf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:41.000Z",
|
|
"modified": "2016-05-02T13:31:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '9d9409781ec8aa0c2a626a654bf268fbf4c17274622ab6de13e4b77c647a17a8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bd-ed3c-4dbc-9570-4bb6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:41.000Z",
|
|
"modified": "2016-05-02T13:31:41.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = '9f016d21b3602ebe3f1f4db6f55e102cfb08084fd0fb2b3413b911a8f993c7f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756be-2c60-4519-9717-4675950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:42.000Z",
|
|
"modified": "2016-05-02T13:31:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'a4dcefc5ee2ac4b7e6de5340ed9b0a8587a5eb612b3c05c8a88a08574a6b55f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756be-3afc-4475-99b6-4358950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:42.000Z",
|
|
"modified": "2016-05-02T13:31:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'b6e64014f488154d6ab3ecafa2d983d0ffc9ae51b8a42e50950fbea8459c98a0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756be-b818-4264-8423-4bc6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:42.000Z",
|
|
"modified": "2016-05-02T13:31:42.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'bf98da36f38ab272cd85278431e27ab5cd33dbf246fc7d8de36895029c5db3c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bf-f040-40df-88fa-4019950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:43.000Z",
|
|
"modified": "2016-05-02T13:31:43.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'bfe7c595cd62735531d899ea9eb4f136baba528e0861c3295cde21165c49691a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bf-33ac-4bab-8967-44b6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:43.000Z",
|
|
"modified": "2016-05-02T13:31:43.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'da972bbefc73e20fd3fd14d2ef4efb2bf17fff2d44888ec457c093b5255a298e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756bf-2880-4402-92c8-49df950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:43.000Z",
|
|
"modified": "2016-05-02T13:31:43.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'e74c3b68554d7d4df8e8fac34ca743cd06337d2728fb278943a2a990b5083757']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756c0-4ea0-441d-b603-4cc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:44.000Z",
|
|
"modified": "2016-05-02T13:31:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'e9a035eb5bc138956ed71c492e0e5c02234fac1c0759cc10b927faca8a5bbd83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756c0-4234-422a-824b-4e6c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:44.000Z",
|
|
"modified": "2016-05-02T13:31:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'f1c66afb8092d2ac19096dda7bf04b71c3f15b616611003a4ace890899988c3f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756c0-8d24-4096-b3ab-46c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:44.000Z",
|
|
"modified": "2016-05-02T13:31:44.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'f5807ba9c092deb76d55a48d62873ad900b9c5d4aec4e3d7ba52c7ed03d3064c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756c1-e558-492e-a990-45a1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:45.000Z",
|
|
"modified": "2016-05-02T13:31:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'f8996e8559527221c4a93f131c8d10388750524f4edaf74aa1eb7fc77f59aee9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572756c1-623c-4ec1-98e6-4b91950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:31:45.000Z",
|
|
"modified": "2016-05-02T13:31:45.000Z",
|
|
"description": "Observed Hashes",
|
|
"pattern": "[file:hashes.SHA256 = 'fa64128c14c8a517e7d60b317896139db8e86b5f1a831c45cbcbcc1b62c14a3e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:31:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275753-4898-44cf-bd84-4614950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:34:11.000Z",
|
|
"modified": "2016-05-02T13:34:11.000Z",
|
|
"first_observed": "2016-05-02T13:34:11Z",
|
|
"last_observed": "2016-05-02T13:34:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275753-4898-44cf-bd84-4614950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275753-4898-44cf-bd84-4614950d210f",
|
|
"value": "http://researchcenter.paloaltonetworks.com/2016/05/prince-of-persia-infy-malware-active-in-decade-of-targeted-attacks/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275893-5090-45c6-8268-457b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:31.000Z",
|
|
"modified": "2016-05-02T13:39:31.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fa64128c14c8a517e7d60b317896139db8e86b5f1a831c45cbcbcc1b62c14a3e",
|
|
"pattern": "[file:hashes.SHA1 = '9666e88fe65bb0bee6ef918de8c29f0f3e62e38d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275894-8bf0-481a-9736-4d9002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:32.000Z",
|
|
"modified": "2016-05-02T13:39:32.000Z",
|
|
"first_observed": "2016-05-02T13:39:32Z",
|
|
"last_observed": "2016-05-02T13:39:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275894-8bf0-481a-9736-4d9002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275894-8bf0-481a-9736-4d9002de0b81",
|
|
"value": "https://www.virustotal.com/file/fa64128c14c8a517e7d60b317896139db8e86b5f1a831c45cbcbcc1b62c14a3e/analysis/1453548338/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275894-2298-4600-8967-4d8002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:32.000Z",
|
|
"modified": "2016-05-02T13:39:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f8996e8559527221c4a93f131c8d10388750524f4edaf74aa1eb7fc77f59aee9",
|
|
"pattern": "[file:hashes.SHA1 = 'b5431cfc762131c24c07e63a20c654e027dabeb0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275894-85fc-43ec-abc2-4aa902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:32.000Z",
|
|
"modified": "2016-05-02T13:39:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f8996e8559527221c4a93f131c8d10388750524f4edaf74aa1eb7fc77f59aee9",
|
|
"pattern": "[file:hashes.MD5 = 'df70cff8cabf0cfc1eb9754020982c49']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275895-2a78-44bc-8928-47b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:33.000Z",
|
|
"modified": "2016-05-02T13:39:33.000Z",
|
|
"first_observed": "2016-05-02T13:39:33Z",
|
|
"last_observed": "2016-05-02T13:39:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275895-2a78-44bc-8928-47b802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275895-2a78-44bc-8928-47b802de0b81",
|
|
"value": "https://www.virustotal.com/file/f8996e8559527221c4a93f131c8d10388750524f4edaf74aa1eb7fc77f59aee9/analysis/1413286476/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275895-2a10-4f3f-b674-41f902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:33.000Z",
|
|
"modified": "2016-05-02T13:39:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f5807ba9c092deb76d55a48d62873ad900b9c5d4aec4e3d7ba52c7ed03d3064c",
|
|
"pattern": "[file:hashes.SHA1 = '66fd2f8d54ed3ee176df3877cafcfb1942af2608']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275896-4594-47d5-9831-406802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:34.000Z",
|
|
"modified": "2016-05-02T13:39:34.000Z",
|
|
"first_observed": "2016-05-02T13:39:34Z",
|
|
"last_observed": "2016-05-02T13:39:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275896-4594-47d5-9831-406802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275896-4594-47d5-9831-406802de0b81",
|
|
"value": "https://www.virustotal.com/file/f5807ba9c092deb76d55a48d62873ad900b9c5d4aec4e3d7ba52c7ed03d3064c/analysis/1450074430/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275896-3b6c-48cb-b682-40d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:34.000Z",
|
|
"modified": "2016-05-02T13:39:34.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f1c66afb8092d2ac19096dda7bf04b71c3f15b616611003a4ace890899988c3f",
|
|
"pattern": "[file:hashes.SHA1 = '640ac56f183896befba638b761903a196f47cc6f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275896-a6d8-4490-b9f2-44bd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:34.000Z",
|
|
"modified": "2016-05-02T13:39:34.000Z",
|
|
"first_observed": "2016-05-02T13:39:34Z",
|
|
"last_observed": "2016-05-02T13:39:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275896-a6d8-4490-b9f2-44bd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275896-a6d8-4490-b9f2-44bd02de0b81",
|
|
"value": "https://www.virustotal.com/file/f1c66afb8092d2ac19096dda7bf04b71c3f15b616611003a4ace890899988c3f/analysis/1403687573/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275897-dbb4-4484-b937-40b402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:35.000Z",
|
|
"modified": "2016-05-02T13:39:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e9a035eb5bc138956ed71c492e0e5c02234fac1c0759cc10b927faca8a5bbd83",
|
|
"pattern": "[file:hashes.SHA1 = '2a38e4852e306f51a4f711473fc5432923583d76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275897-f520-4c35-a006-434c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:35.000Z",
|
|
"modified": "2016-05-02T13:39:35.000Z",
|
|
"first_observed": "2016-05-02T13:39:35Z",
|
|
"last_observed": "2016-05-02T13:39:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275897-f520-4c35-a006-434c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275897-f520-4c35-a006-434c02de0b81",
|
|
"value": "https://www.virustotal.com/file/e9a035eb5bc138956ed71c492e0e5c02234fac1c0759cc10b927faca8a5bbd83/analysis/1394050220/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275898-c168-4e00-9ea8-490c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:36.000Z",
|
|
"modified": "2016-05-02T13:39:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e74c3b68554d7d4df8e8fac34ca743cd06337d2728fb278943a2a990b5083757",
|
|
"pattern": "[file:hashes.SHA1 = '45dc1b379ad7d8dba6c65a5aa1e67d8b6c5e4243']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275898-38cc-4de0-bf47-48e502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:36.000Z",
|
|
"modified": "2016-05-02T13:39:36.000Z",
|
|
"first_observed": "2016-05-02T13:39:36Z",
|
|
"last_observed": "2016-05-02T13:39:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275898-38cc-4de0-bf47-48e502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275898-38cc-4de0-bf47-48e502de0b81",
|
|
"value": "https://www.virustotal.com/file/e74c3b68554d7d4df8e8fac34ca743cd06337d2728fb278943a2a990b5083757/analysis/1452637653/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275899-9a0c-42aa-af9c-4dd802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:37.000Z",
|
|
"modified": "2016-05-02T13:39:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: da972bbefc73e20fd3fd14d2ef4efb2bf17fff2d44888ec457c093b5255a298e",
|
|
"pattern": "[file:hashes.SHA1 = 'c88f36fcc15d9619e7186be45144b6642ac4de5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275899-dbc4-46a4-ab7d-420302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:37.000Z",
|
|
"modified": "2016-05-02T13:39:37.000Z",
|
|
"first_observed": "2016-05-02T13:39:37Z",
|
|
"last_observed": "2016-05-02T13:39:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275899-dbc4-46a4-ab7d-420302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275899-dbc4-46a4-ab7d-420302de0b81",
|
|
"value": "https://www.virustotal.com/file/da972bbefc73e20fd3fd14d2ef4efb2bf17fff2d44888ec457c093b5255a298e/analysis/1452542834/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275899-4464-48bf-93ea-413c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:37.000Z",
|
|
"modified": "2016-05-02T13:39:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bfe7c595cd62735531d899ea9eb4f136baba528e0861c3295cde21165c49691a",
|
|
"pattern": "[file:hashes.SHA1 = 'f1557cfdfe23a30d1538665c5782bdac4c1cb841']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589a-d628-4c8f-8261-407002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:38.000Z",
|
|
"modified": "2016-05-02T13:39:38.000Z",
|
|
"first_observed": "2016-05-02T13:39:38Z",
|
|
"last_observed": "2016-05-02T13:39:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589a-d628-4c8f-8261-407002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589a-d628-4c8f-8261-407002de0b81",
|
|
"value": "https://www.virustotal.com/file/bfe7c595cd62735531d899ea9eb4f136baba528e0861c3295cde21165c49691a/analysis/1452590918/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589a-e79c-45ad-802f-45f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:38.000Z",
|
|
"modified": "2016-05-02T13:39:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bf98da36f38ab272cd85278431e27ab5cd33dbf246fc7d8de36895029c5db3c9",
|
|
"pattern": "[file:hashes.SHA1 = '073169845bac2cb2b5570dcd4629483f55e6bab4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589b-62b8-46ea-a78e-477102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:39.000Z",
|
|
"modified": "2016-05-02T13:39:39.000Z",
|
|
"first_observed": "2016-05-02T13:39:39Z",
|
|
"last_observed": "2016-05-02T13:39:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589b-62b8-46ea-a78e-477102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589b-62b8-46ea-a78e-477102de0b81",
|
|
"value": "https://www.virustotal.com/file/bf98da36f38ab272cd85278431e27ab5cd33dbf246fc7d8de36895029c5db3c9/analysis/1453337787/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589b-94f4-4cd8-a012-4a4002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:39.000Z",
|
|
"modified": "2016-05-02T13:39:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b6e64014f488154d6ab3ecafa2d983d0ffc9ae51b8a42e50950fbea8459c98a0",
|
|
"pattern": "[file:hashes.SHA1 = 'b0cf5ffb01a31346e4de5248b959c8f0296c7494']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589b-c220-4b20-adc2-440b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:39.000Z",
|
|
"modified": "2016-05-02T13:39:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b6e64014f488154d6ab3ecafa2d983d0ffc9ae51b8a42e50950fbea8459c98a0",
|
|
"pattern": "[file:hashes.MD5 = '7b681f3bfa2b30b5fc909b130bbafd50']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589c-feb0-441b-8e31-484a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:40.000Z",
|
|
"modified": "2016-05-02T13:39:40.000Z",
|
|
"first_observed": "2016-05-02T13:39:40Z",
|
|
"last_observed": "2016-05-02T13:39:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589c-feb0-441b-8e31-484a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589c-feb0-441b-8e31-484a02de0b81",
|
|
"value": "https://www.virustotal.com/file/b6e64014f488154d6ab3ecafa2d983d0ffc9ae51b8a42e50950fbea8459c98a0/analysis/1411378233/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589c-c3c4-42d9-88f9-415c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:40.000Z",
|
|
"modified": "2016-05-02T13:39:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a4dcefc5ee2ac4b7e6de5340ed9b0a8587a5eb612b3c05c8a88a08574a6b55f0",
|
|
"pattern": "[file:hashes.SHA1 = '210fff1169a9b3f82951dad8ad57821e7ea63916']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589c-0e58-4fa7-8d05-477002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:40.000Z",
|
|
"modified": "2016-05-02T13:39:40.000Z",
|
|
"first_observed": "2016-05-02T13:39:40Z",
|
|
"last_observed": "2016-05-02T13:39:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589c-0e58-4fa7-8d05-477002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589c-0e58-4fa7-8d05-477002de0b81",
|
|
"value": "https://www.virustotal.com/file/a4dcefc5ee2ac4b7e6de5340ed9b0a8587a5eb612b3c05c8a88a08574a6b55f0/analysis/1452658922/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589d-4c50-446e-bc99-454302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:41.000Z",
|
|
"modified": "2016-05-02T13:39:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9f016d21b3602ebe3f1f4db6f55e102cfb08084fd0fb2b3413b911a8f993c7f8",
|
|
"pattern": "[file:hashes.SHA1 = 'a0b0a54c7708cbf9b5105ce3269dfcee742536b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589d-8a04-41e1-af3d-4d9b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:41.000Z",
|
|
"modified": "2016-05-02T13:39:41.000Z",
|
|
"first_observed": "2016-05-02T13:39:41Z",
|
|
"last_observed": "2016-05-02T13:39:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589d-8a04-41e1-af3d-4d9b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589d-8a04-41e1-af3d-4d9b02de0b81",
|
|
"value": "https://www.virustotal.com/file/9f016d21b3602ebe3f1f4db6f55e102cfb08084fd0fb2b3413b911a8f993c7f8/analysis/1458287901/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589d-c97c-481e-8991-411b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:41.000Z",
|
|
"modified": "2016-05-02T13:39:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d9409781ec8aa0c2a626a654bf268fbf4c17274622ab6de13e4b77c647a17a8",
|
|
"pattern": "[file:hashes.SHA1 = 'a84e36ca87078a7c5095396ce1031e5de5415a6c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589e-30e4-4ce5-9684-4c0002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:42.000Z",
|
|
"modified": "2016-05-02T13:39:42.000Z",
|
|
"first_observed": "2016-05-02T13:39:42Z",
|
|
"last_observed": "2016-05-02T13:39:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589e-30e4-4ce5-9684-4c0002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589e-30e4-4ce5-9684-4c0002de0b81",
|
|
"value": "https://www.virustotal.com/file/9d9409781ec8aa0c2a626a654bf268fbf4c17274622ab6de13e4b77c647a17a8/analysis/1452865291/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589e-b080-4625-b02d-4a6402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:42.000Z",
|
|
"modified": "2016-05-02T13:39:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9a1bacaeec8c625bec6116743ba1427b34c493351e3c31e89d3121bb379ceae6",
|
|
"pattern": "[file:hashes.SHA1 = '8b577106fee6667ffe5e11413ca26e634e9365d7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589e-bba4-4f46-aa77-45cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:42.000Z",
|
|
"modified": "2016-05-02T13:39:42.000Z",
|
|
"first_observed": "2016-05-02T13:39:42Z",
|
|
"last_observed": "2016-05-02T13:39:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589e-bba4-4f46-aa77-45cb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589e-bba4-4f46-aa77-45cb02de0b81",
|
|
"value": "https://www.virustotal.com/file/9a1bacaeec8c625bec6116743ba1427b34c493351e3c31e89d3121bb379ceae6/analysis/1450505458/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589f-fd3c-4edd-9484-47b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:43.000Z",
|
|
"modified": "2016-05-02T13:39:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 98dddf6797f1a64ba94663169355e32bf8a17e84f368fecc2300413e62a6de2b",
|
|
"pattern": "[file:hashes.SHA1 = '508a50a661cf3055b49d0b85b53acdab9abe004c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727589f-e094-453a-a8c3-490c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:43.000Z",
|
|
"modified": "2016-05-02T13:39:43.000Z",
|
|
"first_observed": "2016-05-02T13:39:43Z",
|
|
"last_observed": "2016-05-02T13:39:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727589f-e094-453a-a8c3-490c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727589f-e094-453a-a8c3-490c02de0b81",
|
|
"value": "https://www.virustotal.com/file/98dddf6797f1a64ba94663169355e32bf8a17e84f368fecc2300413e62a6de2b/analysis/1450704561/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727589f-4098-4d06-b3cd-469602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:43.000Z",
|
|
"modified": "2016-05-02T13:39:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 942a23901f2f23f07ddac1384995b9e5fee73b649aef2dc6fb934230c010160c",
|
|
"pattern": "[file:hashes.SHA1 = 'f643866f664741b39c4454d3ef4f66121e24b8b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a0-c568-4c6a-809b-453902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:44.000Z",
|
|
"modified": "2016-05-02T13:39:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 942a23901f2f23f07ddac1384995b9e5fee73b649aef2dc6fb934230c010160c",
|
|
"pattern": "[file:hashes.MD5 = '2546f1499a347bfd7dbe79828560f043']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a0-d51c-45d7-9e3e-448802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:44.000Z",
|
|
"modified": "2016-05-02T13:39:44.000Z",
|
|
"first_observed": "2016-05-02T13:39:44Z",
|
|
"last_observed": "2016-05-02T13:39:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a0-d51c-45d7-9e3e-448802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a0-d51c-45d7-9e3e-448802de0b81",
|
|
"value": "https://www.virustotal.com/file/942a23901f2f23f07ddac1384995b9e5fee73b649aef2dc6fb934230c010160c/analysis/1425436238/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a0-f88c-46e9-899f-4d8102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:44.000Z",
|
|
"modified": "2016-05-02T13:39:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 93eb61afd4411ea9c867d11a46a410d84620ef0a57ace2f73882dae5f48572c3",
|
|
"pattern": "[file:hashes.SHA1 = 'a47225ec6278d4aa72e48dc00e26a457d8ce5c90']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a1-e35c-43c9-b4c3-470702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:45.000Z",
|
|
"modified": "2016-05-02T13:39:45.000Z",
|
|
"first_observed": "2016-05-02T13:39:45Z",
|
|
"last_observed": "2016-05-02T13:39:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a1-e35c-43c9-b4c3-470702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a1-e35c-43c9-b4c3-470702de0b81",
|
|
"value": "https://www.virustotal.com/file/93eb61afd4411ea9c867d11a46a410d84620ef0a57ace2f73882dae5f48572c3/analysis/1458050667/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a1-fdd8-45a9-a6b6-4d0202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:45.000Z",
|
|
"modified": "2016-05-02T13:39:45.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9370b0cd2a4d6affa4ab9a575ff9349b68c85b0b0dca3bfc08a0f8f8a66875f5",
|
|
"pattern": "[file:hashes.SHA1 = 'cdf2ea7dc41094f9db00ff4b75a53c14e7da2152']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a1-19e0-49b4-af0d-4a3202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:45.000Z",
|
|
"modified": "2016-05-02T13:39:45.000Z",
|
|
"first_observed": "2016-05-02T13:39:45Z",
|
|
"last_observed": "2016-05-02T13:39:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a1-19e0-49b4-af0d-4a3202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a1-19e0-49b4-af0d-4a3202de0b81",
|
|
"value": "https://www.virustotal.com/file/9370b0cd2a4d6affa4ab9a575ff9349b68c85b0b0dca3bfc08a0f8f8a66875f5/analysis/1455539274/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a2-2168-422a-a85a-431c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:46.000Z",
|
|
"modified": "2016-05-02T13:39:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8d8b9dcbc8c54316ac0cc3fb69058f75449ff60ffe62023f236201011920f91e",
|
|
"pattern": "[file:hashes.SHA1 = '94dd10e802432f4c2bc88865a23c3795d7e2b1bd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a2-e594-4a2d-b68f-42a402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:46.000Z",
|
|
"modified": "2016-05-02T13:39:46.000Z",
|
|
"first_observed": "2016-05-02T13:39:46Z",
|
|
"last_observed": "2016-05-02T13:39:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a2-e594-4a2d-b68f-42a402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a2-e594-4a2d-b68f-42a402de0b81",
|
|
"value": "https://www.virustotal.com/file/8d8b9dcbc8c54316ac0cc3fb69058f75449ff60ffe62023f236201011920f91e/analysis/1453082445/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a2-64a8-435e-8699-424202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:46.000Z",
|
|
"modified": "2016-05-02T13:39:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 831a9f71391fb6a32b5ddcdbc62e6ac71c3a083c9d76d74911a620b2d7535783",
|
|
"pattern": "[file:hashes.SHA1 = '833755bc04cf3055d49db057204a86b07773dd8a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a3-a334-4043-90ef-40a402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:47.000Z",
|
|
"modified": "2016-05-02T13:39:47.000Z",
|
|
"first_observed": "2016-05-02T13:39:47Z",
|
|
"last_observed": "2016-05-02T13:39:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a3-a334-4043-90ef-40a402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a3-a334-4043-90ef-40a402de0b81",
|
|
"value": "https://www.virustotal.com/file/831a9f71391fb6a32b5ddcdbc62e6ac71c3a083c9d76d74911a620b2d7535783/analysis/1403690842/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a3-578c-4dc6-ab3b-4dd502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:47.000Z",
|
|
"modified": "2016-05-02T13:39:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7fd19d3fbe2ad1374a15ec128a9244ad817dbd81ce635516c7c4b4f1f1f6160e",
|
|
"pattern": "[file:hashes.SHA1 = 'f6b05ee6a53c5a413260f375fa933089f5acb5d9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a3-626c-430e-96e3-4af502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:47.000Z",
|
|
"modified": "2016-05-02T13:39:47.000Z",
|
|
"first_observed": "2016-05-02T13:39:47Z",
|
|
"last_observed": "2016-05-02T13:39:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a3-626c-430e-96e3-4af502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a3-626c-430e-96e3-4af502de0b81",
|
|
"value": "https://www.virustotal.com/file/7fd19d3fbe2ad1374a15ec128a9244ad817dbd81ce635516c7c4b4f1f1f6160e/analysis/1458287902/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a4-9e28-4b58-833b-47d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:48.000Z",
|
|
"modified": "2016-05-02T13:39:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7e0a57d205d718740cd31fc55b3ab44411872c3da486d28466be31f0b1db68b4",
|
|
"pattern": "[file:hashes.SHA1 = 'e3d2ef5f010dc7fea02b281f882adc78b5fbfbac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a4-e020-428c-a558-4cb702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:48.000Z",
|
|
"modified": "2016-05-02T13:39:48.000Z",
|
|
"first_observed": "2016-05-02T13:39:48Z",
|
|
"last_observed": "2016-05-02T13:39:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a4-e020-428c-a558-4cb702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a4-e020-428c-a558-4cb702de0b81",
|
|
"value": "https://www.virustotal.com/file/7e0a57d205d718740cd31fc55b3ab44411872c3da486d28466be31f0b1db68b4/analysis/1452627392/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a4-23dc-483e-a541-4eec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:48.000Z",
|
|
"modified": "2016-05-02T13:39:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7bb0222d771c6a68d2f08772755b19af6d24f5ed144c6890b98eea19b24467d3",
|
|
"pattern": "[file:hashes.SHA1 = '7e0c222e228e384bac62e978c480a913703ee917']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a5-9300-4af8-95f9-4c2102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:49.000Z",
|
|
"modified": "2016-05-02T13:39:49.000Z",
|
|
"first_observed": "2016-05-02T13:39:49Z",
|
|
"last_observed": "2016-05-02T13:39:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a5-9300-4af8-95f9-4c2102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a5-9300-4af8-95f9-4c2102de0b81",
|
|
"value": "https://www.virustotal.com/file/7bb0222d771c6a68d2f08772755b19af6d24f5ed144c6890b98eea19b24467d3/analysis/1395563544/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a5-53d8-4ed8-8215-45a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:49.000Z",
|
|
"modified": "2016-05-02T13:39:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7b0bc1442036e4fed232073ffcf13322d1d5fd9b60a2b8c0f14848d6e3c4a596",
|
|
"pattern": "[file:hashes.SHA1 = 'b80cccda4c80c05655334aea6b9b08fec54e4d24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a6-b4d4-4b93-963d-47d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:50.000Z",
|
|
"modified": "2016-05-02T13:39:50.000Z",
|
|
"first_observed": "2016-05-02T13:39:50Z",
|
|
"last_observed": "2016-05-02T13:39:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a6-b4d4-4b93-963d-47d502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a6-b4d4-4b93-963d-47d502de0b81",
|
|
"value": "https://www.virustotal.com/file/7b0bc1442036e4fed232073ffcf13322d1d5fd9b60a2b8c0f14848d6e3c4a596/analysis/1450361281/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a6-8788-417e-9885-459102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:50.000Z",
|
|
"modified": "2016-05-02T13:39:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 763f8ab16e1640865e4aff4d7214f8ab1a3acc2400f68445191be5aaf4ed3215",
|
|
"pattern": "[file:hashes.SHA1 = '6b9248d2917611498cf61926544c49e24971ed5b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a7-d6f4-4ebc-a956-4ced02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:51.000Z",
|
|
"modified": "2016-05-02T13:39:51.000Z",
|
|
"first_observed": "2016-05-02T13:39:51Z",
|
|
"last_observed": "2016-05-02T13:39:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a7-d6f4-4ebc-a956-4ced02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a7-d6f4-4ebc-a956-4ced02de0b81",
|
|
"value": "https://www.virustotal.com/file/763f8ab16e1640865e4aff4d7214f8ab1a3acc2400f68445191be5aaf4ed3215/analysis/1376375216/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a7-d1d0-4b12-a0df-4f6402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:51.000Z",
|
|
"modified": "2016-05-02T13:39:51.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 69b85527e2f67454c6397f7d099aa6327861d957e7fadc033ce09a395036caac",
|
|
"pattern": "[file:hashes.SHA1 = 'c17991af67cab9bc6031205bff0522c6d74cd478']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a7-47c8-42d6-acf9-4f8602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:51.000Z",
|
|
"modified": "2016-05-02T13:39:51.000Z",
|
|
"first_observed": "2016-05-02T13:39:51Z",
|
|
"last_observed": "2016-05-02T13:39:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a7-47c8-42d6-acf9-4f8602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a7-47c8-42d6-acf9-4f8602de0b81",
|
|
"value": "https://www.virustotal.com/file/69b85527e2f67454c6397f7d099aa6327861d957e7fadc033ce09a395036caac/analysis/1380626891/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a8-21a0-4ca4-bc8e-47ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:52.000Z",
|
|
"modified": "2016-05-02T13:39:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 597ed121a6e8bbee3a0cc9e167211a9ca165dd7e1f2d37c92ab97f189058861d",
|
|
"pattern": "[file:hashes.SHA1 = 'a42f97b325e1cdfa8c0824d93e08f8369885ee84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a8-acc0-40fb-9f6e-4c9602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:52.000Z",
|
|
"modified": "2016-05-02T13:39:52.000Z",
|
|
"first_observed": "2016-05-02T13:39:52Z",
|
|
"last_observed": "2016-05-02T13:39:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a8-acc0-40fb-9f6e-4c9602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a8-acc0-40fb-9f6e-4c9602de0b81",
|
|
"value": "https://www.virustotal.com/file/597ed121a6e8bbee3a0cc9e167211a9ca165dd7e1f2d37c92ab97f189058861d/analysis/1411687852/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a9-d820-481c-a488-429b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:53.000Z",
|
|
"modified": "2016-05-02T13:39:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4e37491e7a25c029c5ec6738c57f9d08d551162baf276d9fb576b6849badaf5a",
|
|
"pattern": "[file:hashes.SHA1 = '60224c3921c5369cad83fa235673c1dc4072a3f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758a9-08f4-453e-a53a-42d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:53.000Z",
|
|
"modified": "2016-05-02T13:39:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4e37491e7a25c029c5ec6738c57f9d08d551162baf276d9fb576b6849badaf5a",
|
|
"pattern": "[file:hashes.MD5 = '591d59fcc263dfc4f5c4aed12aea7f0c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758a9-dd84-4221-8c40-42f302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:53.000Z",
|
|
"modified": "2016-05-02T13:39:53.000Z",
|
|
"first_observed": "2016-05-02T13:39:53Z",
|
|
"last_observed": "2016-05-02T13:39:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758a9-dd84-4221-8c40-42f302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758a9-dd84-4221-8c40-42f302de0b81",
|
|
"value": "https://www.virustotal.com/file/4e37491e7a25c029c5ec6738c57f9d08d551162baf276d9fb576b6849badaf5a/analysis/1412410387/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758aa-5590-4700-8447-427202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:54.000Z",
|
|
"modified": "2016-05-02T13:39:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4d1ca3d0a71862d0fd828310aa2750509b4647de3506acf7a417b088091ad56b",
|
|
"pattern": "[file:hashes.SHA1 = '15df18fef2c541f94f61b8b9927f0ba7b4614b65']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758aa-e4a4-4dae-af90-482c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:54.000Z",
|
|
"modified": "2016-05-02T13:39:54.000Z",
|
|
"first_observed": "2016-05-02T13:39:54Z",
|
|
"last_observed": "2016-05-02T13:39:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758aa-e4a4-4dae-af90-482c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758aa-e4a4-4dae-af90-482c02de0b81",
|
|
"value": "https://www.virustotal.com/file/4d1ca3d0a71862d0fd828310aa2750509b4647de3506acf7a417b088091ad56b/analysis/1452588940/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ab-7918-4ab8-b611-4a6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:55.000Z",
|
|
"modified": "2016-05-02T13:39:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 45ce1e1efaeb44bc9ac7996aba4e866c0cd80bda1ffe25d46c0a3f6a4fc12f9d",
|
|
"pattern": "[file:hashes.SHA1 = '8bea4bdd98f07e533ab966700b8a6520d9ac0121']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ab-12c0-45d5-9e5c-484802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:55.000Z",
|
|
"modified": "2016-05-02T13:39:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 45ce1e1efaeb44bc9ac7996aba4e866c0cd80bda1ffe25d46c0a3f6a4fc12f9d",
|
|
"pattern": "[file:hashes.MD5 = '086f4d1411e2209bb321d3fa75bf0a6f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ab-9e58-4522-a31d-442502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:55.000Z",
|
|
"modified": "2016-05-02T13:39:55.000Z",
|
|
"first_observed": "2016-05-02T13:39:55Z",
|
|
"last_observed": "2016-05-02T13:39:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ab-9e58-4522-a31d-442502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ab-9e58-4522-a31d-442502de0b81",
|
|
"value": "https://www.virustotal.com/file/45ce1e1efaeb44bc9ac7996aba4e866c0cd80bda1ffe25d46c0a3f6a4fc12f9d/analysis/1413283447/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ac-729c-4604-9ab2-44a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:56.000Z",
|
|
"modified": "2016-05-02T13:39:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 43bd06de8cfc34a98ed59b29a9499d934bfe5aeb541a87296e5b509dd4a50514",
|
|
"pattern": "[file:hashes.SHA1 = 'd08665b73f076329213d216b940d74353a138d66']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ac-b200-4456-9b9f-413b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:56.000Z",
|
|
"modified": "2016-05-02T13:39:56.000Z",
|
|
"first_observed": "2016-05-02T13:39:56Z",
|
|
"last_observed": "2016-05-02T13:39:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ac-b200-4456-9b9f-413b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ac-b200-4456-9b9f-413b02de0b81",
|
|
"value": "https://www.virustotal.com/file/43bd06de8cfc34a98ed59b29a9499d934bfe5aeb541a87296e5b509dd4a50514/analysis/1371880399/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ad-3030-4aea-8de3-4d8b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:57.000Z",
|
|
"modified": "2016-05-02T13:39:57.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4398d635849ba7c909d62c6cea76e7ae875fd0d998d6e606e7e343b4194857b7",
|
|
"pattern": "[file:hashes.SHA1 = 'fd9eb6c4d5525aad6b18d0b903ec69b5bea0fbf9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ad-1604-461f-80fa-48f802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:57.000Z",
|
|
"modified": "2016-05-02T13:39:57.000Z",
|
|
"first_observed": "2016-05-02T13:39:57Z",
|
|
"last_observed": "2016-05-02T13:39:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ad-1604-461f-80fa-48f802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ad-1604-461f-80fa-48f802de0b81",
|
|
"value": "https://www.virustotal.com/file/4398d635849ba7c909d62c6cea76e7ae875fd0d998d6e606e7e343b4194857b7/analysis/1445891465/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ae-7e54-4f08-8446-431702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:58.000Z",
|
|
"modified": "2016-05-02T13:39:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 391953799e25a7d4df62381dc02f23f96f200688c3e21f7b732e39275b8e9f27",
|
|
"pattern": "[file:hashes.SHA1 = 'bd63ba5e8627a52c1f0f7fab9f26bddca7126f7a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ae-4398-4543-bab6-4e0602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:58.000Z",
|
|
"modified": "2016-05-02T13:39:58.000Z",
|
|
"first_observed": "2016-05-02T13:39:58Z",
|
|
"last_observed": "2016-05-02T13:39:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ae-4398-4543-bab6-4e0602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ae-4398-4543-bab6-4e0602de0b81",
|
|
"value": "https://www.virustotal.com/file/391953799e25a7d4df62381dc02f23f96f200688c3e21f7b732e39275b8e9f27/analysis/1425719311/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ae-44dc-4506-b72e-42a402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:58.000Z",
|
|
"modified": "2016-05-02T13:39:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 354dd026033764ece26f3248e1cbaa504bcd2c556794921498b3b083be42b437",
|
|
"pattern": "[file:hashes.SHA1 = '5a0177cd9544f62e63b9c765e4b60bc2fcd601a2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758af-c64c-443a-a239-4c9502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:59.000Z",
|
|
"modified": "2016-05-02T13:39:59.000Z",
|
|
"first_observed": "2016-05-02T13:39:59Z",
|
|
"last_observed": "2016-05-02T13:39:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758af-c64c-443a-a239-4c9502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758af-c64c-443a-a239-4c9502de0b81",
|
|
"value": "https://www.virustotal.com/file/354dd026033764ece26f3248e1cbaa504bcd2c556794921498b3b083be42b437/analysis/1453769989/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758af-4c4c-4952-ba89-452202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:39:59.000Z",
|
|
"modified": "2016-05-02T13:39:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1acb2e942d0c73214155ced4f7f11b84c2f92a3988e6203b817a98ba91ebca2a",
|
|
"pattern": "[file:hashes.SHA1 = 'a509848749b70e40319ef74a8606364a8732a5a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:39:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b0-21a4-429d-aadf-495602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:00.000Z",
|
|
"modified": "2016-05-02T13:40:00.000Z",
|
|
"first_observed": "2016-05-02T13:40:00Z",
|
|
"last_observed": "2016-05-02T13:40:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b0-21a4-429d-aadf-495602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b0-21a4-429d-aadf-495602de0b81",
|
|
"value": "https://www.virustotal.com/file/1acb2e942d0c73214155ced4f7f11b84c2f92a3988e6203b817a98ba91ebca2a/analysis/1453084054/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b0-be60-4ebc-a46f-498002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:00.000Z",
|
|
"modified": "2016-05-02T13:40:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 14fb0d3dda2e183a114336a3e4fe6668a5979bfc716a82e62d059d046800137e",
|
|
"pattern": "[file:hashes.SHA1 = '02926e1820f017530270b33b7aa10bd1472f5f63']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b1-cabc-4f6e-8a21-426a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:01.000Z",
|
|
"modified": "2016-05-02T13:40:01.000Z",
|
|
"first_observed": "2016-05-02T13:40:01Z",
|
|
"last_observed": "2016-05-02T13:40:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b1-cabc-4f6e-8a21-426a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b1-cabc-4f6e-8a21-426a02de0b81",
|
|
"value": "https://www.virustotal.com/file/14fb0d3dda2e183a114336a3e4fe6668a5979bfc716a82e62d059d046800137e/analysis/1349442078/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b1-75f4-41ec-86e3-4aa202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:01.000Z",
|
|
"modified": "2016-05-02T13:40:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 084536508fe90416e7609481b3b09a6652d805db866791d3dfe2a9f2a076767f",
|
|
"pattern": "[file:hashes.SHA1 = 'a30ff16557494c67537c9339116e0c8237ccf646']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b1-0948-478c-850e-47c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:01.000Z",
|
|
"modified": "2016-05-02T13:40:01.000Z",
|
|
"first_observed": "2016-05-02T13:40:01Z",
|
|
"last_observed": "2016-05-02T13:40:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b1-0948-478c-850e-47c602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b1-0948-478c-850e-47c602de0b81",
|
|
"value": "https://www.virustotal.com/file/084536508fe90416e7609481b3b09a6652d805db866791d3dfe2a9f2a076767f/analysis/1457863660/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b2-6254-430b-8434-4ceb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:02.000Z",
|
|
"modified": "2016-05-02T13:40:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0598dd550b3854380a4afe915f61ad63ca807d3adf52f4548a49290fbbf7f1e0",
|
|
"pattern": "[file:hashes.SHA1 = '9b6c84d0956ddc4bf0ca2266d55941f782c48e43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b2-5258-44a2-aea6-467902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:02.000Z",
|
|
"modified": "2016-05-02T13:40:02.000Z",
|
|
"first_observed": "2016-05-02T13:40:02Z",
|
|
"last_observed": "2016-05-02T13:40:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b2-5258-44a2-aea6-467902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b2-5258-44a2-aea6-467902de0b81",
|
|
"value": "https://www.virustotal.com/file/0598dd550b3854380a4afe915f61ad63ca807d3adf52f4548a49290fbbf7f1e0/analysis/1428590005/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b3-f0bc-467e-b31a-4d9a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:03.000Z",
|
|
"modified": "2016-05-02T13:40:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 00ccd3155a9c0de0072a4b31d62eb619b099726911ee9a9c8a50ed2a2c44ac80",
|
|
"pattern": "[file:hashes.SHA1 = 'c7e925ed4a5cc01bb4ddc7b3bbea641a6e1f1e4a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b3-aaf8-4359-b916-40b702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:03.000Z",
|
|
"modified": "2016-05-02T13:40:03.000Z",
|
|
"first_observed": "2016-05-02T13:40:03Z",
|
|
"last_observed": "2016-05-02T13:40:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b3-aaf8-4359-b916-40b702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b3-aaf8-4359-b916-40b702de0b81",
|
|
"value": "https://www.virustotal.com/file/00ccd3155a9c0de0072a4b31d62eb619b099726911ee9a9c8a50ed2a2c44ac80/analysis/1458288737/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b3-4d74-4064-a71c-499502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:03.000Z",
|
|
"modified": "2016-05-02T13:40:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fd33a6c08159d1f688fe927076c1e441",
|
|
"pattern": "[file:hashes.SHA256 = '396fe0855855bd45496e896252526001900095bc333dc85b873cf4fcd06679aa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b4-8ccc-4017-9c25-431102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:04.000Z",
|
|
"modified": "2016-05-02T13:40:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fd33a6c08159d1f688fe927076c1e441",
|
|
"pattern": "[file:hashes.SHA1 = '9f46f0a97e1df4cd372777a3bfdeb37b21e48681']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b4-de38-4388-ba72-445402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:04.000Z",
|
|
"modified": "2016-05-02T13:40:04.000Z",
|
|
"first_observed": "2016-05-02T13:40:04Z",
|
|
"last_observed": "2016-05-02T13:40:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b4-de38-4388-ba72-445402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b4-de38-4388-ba72-445402de0b81",
|
|
"value": "https://www.virustotal.com/file/396fe0855855bd45496e896252526001900095bc333dc85b873cf4fcd06679aa/analysis/1407661805/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b5-c964-4273-9fef-401102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:05.000Z",
|
|
"modified": "2016-05-02T13:40:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fcee2e1dd2188d28bd0530c46ca66ab4",
|
|
"pattern": "[file:hashes.SHA256 = '49b72a2665aef3560318bd92f4869cadb5735dc758e35524dcf126e50e017cb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b5-c380-4a5f-8ba8-4e1102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:05.000Z",
|
|
"modified": "2016-05-02T13:40:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fcee2e1dd2188d28bd0530c46ca66ab4",
|
|
"pattern": "[file:hashes.SHA1 = '383fef2e1430ebd1663ae466ba13102e8f6ab19e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b5-2fac-4e76-8f9f-4c7602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:05.000Z",
|
|
"modified": "2016-05-02T13:40:05.000Z",
|
|
"first_observed": "2016-05-02T13:40:05Z",
|
|
"last_observed": "2016-05-02T13:40:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b5-2fac-4e76-8f9f-4c7602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b5-2fac-4e76-8f9f-4c7602de0b81",
|
|
"value": "https://www.virustotal.com/file/49b72a2665aef3560318bd92f4869cadb5735dc758e35524dcf126e50e017cb2/analysis/1458288737/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b6-4400-4fb8-a8e5-47ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:06.000Z",
|
|
"modified": "2016-05-02T13:40:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fcb02cdd979b12a25befef990977072a",
|
|
"pattern": "[file:hashes.SHA256 = 'd99406494ea1fa2338ca62fa37255c3b3a174b25548cd80b78822566b00a4666']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b6-99d0-429b-8b2d-47bc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:06.000Z",
|
|
"modified": "2016-05-02T13:40:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: fcb02cdd979b12a25befef990977072a",
|
|
"pattern": "[file:hashes.SHA1 = 'e6133c597274813b6d98cd152f9973da83bf2b7a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b6-4b64-408f-b786-4b7702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:06.000Z",
|
|
"modified": "2016-05-02T13:40:06.000Z",
|
|
"first_observed": "2016-05-02T13:40:06Z",
|
|
"last_observed": "2016-05-02T13:40:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b6-4b64-408f-b786-4b7702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b6-4b64-408f-b786-4b7702de0b81",
|
|
"value": "https://www.virustotal.com/file/d99406494ea1fa2338ca62fa37255c3b3a174b25548cd80b78822566b00a4666/analysis/1450489435/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b7-f704-44bd-98ff-449702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:07.000Z",
|
|
"modified": "2016-05-02T13:40:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f83ec55fe1c92f95656350deb44e804a",
|
|
"pattern": "[file:hashes.SHA256 = '2c17957e0ff714ca515ce02af018e16138e44afbe45bbb8d27be19db6cfa303a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b7-5098-42d2-8c27-4e3602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:07.000Z",
|
|
"modified": "2016-05-02T13:40:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f83ec55fe1c92f95656350deb44e804a",
|
|
"pattern": "[file:hashes.SHA1 = '548ab01acdcf7142f2d27e7cc9087b98ebbcac95']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b7-ceac-43df-9a2f-493302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:07.000Z",
|
|
"modified": "2016-05-02T13:40:07.000Z",
|
|
"first_observed": "2016-05-02T13:40:07Z",
|
|
"last_observed": "2016-05-02T13:40:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b7-ceac-43df-9a2f-493302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b7-ceac-43df-9a2f-493302de0b81",
|
|
"value": "https://www.virustotal.com/file/2c17957e0ff714ca515ce02af018e16138e44afbe45bbb8d27be19db6cfa303a/analysis/1378764637/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b8-30fc-4908-9aa3-4b5002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:08.000Z",
|
|
"modified": "2016-05-02T13:40:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f37bbbf212ad212dbcbf45e771226f70",
|
|
"pattern": "[file:hashes.SHA256 = '50343b7c0e0af2fda4abf92ed419882c47ff421add6d188b3dfd522e8908cbad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b8-5248-41f1-897f-488a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:08.000Z",
|
|
"modified": "2016-05-02T13:40:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f37bbbf212ad212dbcbf45e771226f70",
|
|
"pattern": "[file:hashes.SHA1 = '001706dd66c6814490afbdffeaa3af95f58695b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758b8-6490-4c9e-9e9e-44fa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:08.000Z",
|
|
"modified": "2016-05-02T13:40:08.000Z",
|
|
"first_observed": "2016-05-02T13:40:08Z",
|
|
"last_observed": "2016-05-02T13:40:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758b8-6490-4c9e-9e9e-44fa02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758b8-6490-4c9e-9e9e-44fa02de0b81",
|
|
"value": "https://www.virustotal.com/file/50343b7c0e0af2fda4abf92ed419882c47ff421add6d188b3dfd522e8908cbad/analysis/1431332752/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b9-41fc-48e2-abc0-4b2c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:09.000Z",
|
|
"modified": "2016-05-02T13:40:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f1c06830c806dc0aaa6c9283bdc1777d",
|
|
"pattern": "[file:hashes.SHA256 = 'b5fb32035d463b0a389a3e49fbdbcc4378b917eba766d2786234f931cd17fa70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758b9-2d58-4e12-b98a-43f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:09.000Z",
|
|
"modified": "2016-05-02T13:40:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f1c06830c806dc0aaa6c9283bdc1777d",
|
|
"pattern": "[file:hashes.SHA1 = 'd0d88bb07a4506c09b68ac44bbb2bb9862648361']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ba-2d84-47d0-8335-4dc702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:10.000Z",
|
|
"modified": "2016-05-02T13:40:10.000Z",
|
|
"first_observed": "2016-05-02T13:40:10Z",
|
|
"last_observed": "2016-05-02T13:40:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ba-2d84-47d0-8335-4dc702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ba-2d84-47d0-8335-4dc702de0b81",
|
|
"value": "https://www.virustotal.com/file/b5fb32035d463b0a389a3e49fbdbcc4378b917eba766d2786234f931cd17fa70/analysis/1382147193/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ba-f4c8-425b-99f1-44da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:10.000Z",
|
|
"modified": "2016-05-02T13:40:10.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f15f75a3f633c334087be5005e5d60ce",
|
|
"pattern": "[file:hashes.SHA256 = '3efdcbbc5e66a5b7faca70dc7c7bb9770720b544587c437fb93473c1ad930835']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bb-0360-46ba-8c2c-4fcc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:11.000Z",
|
|
"modified": "2016-05-02T13:40:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f15f75a3f633c334087be5005e5d60ce",
|
|
"pattern": "[file:hashes.SHA1 = 'e1d6e3abc2f3e63e450a4f09cf7551d9c37cccb9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758bb-ee50-4a20-9112-419f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:11.000Z",
|
|
"modified": "2016-05-02T13:40:11.000Z",
|
|
"first_observed": "2016-05-02T13:40:11Z",
|
|
"last_observed": "2016-05-02T13:40:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758bb-ee50-4a20-9112-419f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758bb-ee50-4a20-9112-419f02de0b81",
|
|
"value": "https://www.virustotal.com/file/3efdcbbc5e66a5b7faca70dc7c7bb9770720b544587c437fb93473c1ad930835/analysis/1458288738/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bb-6b94-429a-9e99-437602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:11.000Z",
|
|
"modified": "2016-05-02T13:40:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f1139f9162bb2e18d2db4793745aa139",
|
|
"pattern": "[file:hashes.SHA256 = '6b3d952861e68b9288da1411fb4b3d43df1a47cf5f1fc9b283e0728abe9246d2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bc-1618-4246-915c-44ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:12.000Z",
|
|
"modified": "2016-05-02T13:40:12.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: f1139f9162bb2e18d2db4793745aa139",
|
|
"pattern": "[file:hashes.SHA1 = '0973fae855d2148367aa31b8c54f2ae709f9cea6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758bc-e28c-4484-91af-4eb102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:12.000Z",
|
|
"modified": "2016-05-02T13:40:12.000Z",
|
|
"first_observed": "2016-05-02T13:40:12Z",
|
|
"last_observed": "2016-05-02T13:40:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758bc-e28c-4484-91af-4eb102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758bc-e28c-4484-91af-4eb102de0b81",
|
|
"value": "https://www.virustotal.com/file/6b3d952861e68b9288da1411fb4b3d43df1a47cf5f1fc9b283e0728abe9246d2/analysis/1374067972/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bd-ae14-4c76-8ae3-4a2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:13.000Z",
|
|
"modified": "2016-05-02T13:40:13.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: efbd383d5a5516445820b013d8f8e207",
|
|
"pattern": "[file:hashes.SHA256 = '8cf3cd8c8887835b00bc0b40b128f00b8606e378c70a68b3b8c79f57acab8f0e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bd-0d08-4e44-818d-424e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:13.000Z",
|
|
"modified": "2016-05-02T13:40:13.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: efbd383d5a5516445820b013d8f8e207",
|
|
"pattern": "[file:hashes.SHA1 = 'a1597e7855a3483012ca44191baeeaa758e4a2ef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758bd-6208-45c4-a020-49ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:13.000Z",
|
|
"modified": "2016-05-02T13:40:13.000Z",
|
|
"first_observed": "2016-05-02T13:40:13Z",
|
|
"last_observed": "2016-05-02T13:40:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758bd-6208-45c4-a020-49ec02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758bd-6208-45c4-a020-49ec02de0b81",
|
|
"value": "https://www.virustotal.com/file/8cf3cd8c8887835b00bc0b40b128f00b8606e378c70a68b3b8c79f57acab8f0e/analysis/1380452840/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758be-3f88-4cd4-95f1-458e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:14.000Z",
|
|
"modified": "2016-05-02T13:40:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ef389dde0e84fb495e9b59c61293f525",
|
|
"pattern": "[file:hashes.SHA256 = 'f73e23ba8a8c43f17e9a10c17cc8c0c87d89e4dceb7fc18fe0723b5a13ec5667']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758be-17c0-4e95-ab6e-4dd502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:14.000Z",
|
|
"modified": "2016-05-02T13:40:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ef389dde0e84fb495e9b59c61293f525",
|
|
"pattern": "[file:hashes.SHA1 = '2b7d3cde8de6b0c94ede4cad9a8fc46d90bdeb83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758bf-c5e4-45f0-a918-48e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:15.000Z",
|
|
"modified": "2016-05-02T13:40:15.000Z",
|
|
"first_observed": "2016-05-02T13:40:15Z",
|
|
"last_observed": "2016-05-02T13:40:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758bf-c5e4-45f0-a918-48e202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758bf-c5e4-45f0-a918-48e202de0b81",
|
|
"value": "https://www.virustotal.com/file/f73e23ba8a8c43f17e9a10c17cc8c0c87d89e4dceb7fc18fe0723b5a13ec5667/analysis/1436202632/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bf-14ec-42ca-8dbe-420402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:15.000Z",
|
|
"modified": "2016-05-02T13:40:15.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ed82c1d1a09f1382a9bb279c06eccd0f",
|
|
"pattern": "[file:hashes.SHA256 = '929a49b8fb18df8e84c43746b901632a4c90dc8749f2c4fe7943779a964683e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758bf-fc74-4773-bdad-476302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:15.000Z",
|
|
"modified": "2016-05-02T13:40:15.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ed82c1d1a09f1382a9bb279c06eccd0f",
|
|
"pattern": "[file:hashes.SHA1 = 'cef9bbe0209b21aeb972bf5263b4c4110afb73fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c0-b464-451b-aed4-449402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:16.000Z",
|
|
"modified": "2016-05-02T13:40:16.000Z",
|
|
"first_observed": "2016-05-02T13:40:16Z",
|
|
"last_observed": "2016-05-02T13:40:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c0-b464-451b-aed4-449402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c0-b464-451b-aed4-449402de0b81",
|
|
"value": "https://www.virustotal.com/file/929a49b8fb18df8e84c43746b901632a4c90dc8749f2c4fe7943779a964683e0/analysis/1361551813/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c0-b76c-4537-bb51-411402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:16.000Z",
|
|
"modified": "2016-05-02T13:40:16.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ed15da7cdc85f8e7e2527646944c7010",
|
|
"pattern": "[file:hashes.SHA256 = '2fd28b285bfe748a61c8b3523960c705d5be81e51abed335e47f6a7728f3a923']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c1-4af8-4c8e-83b0-492402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:17.000Z",
|
|
"modified": "2016-05-02T13:40:17.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ed15da7cdc85f8e7e2527646944c7010",
|
|
"pattern": "[file:hashes.SHA1 = '2696c9ba0f9766c2ac7d05f3ea0c2c64a7a4d26a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c1-ffec-466f-907b-433202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:17.000Z",
|
|
"modified": "2016-05-02T13:40:17.000Z",
|
|
"first_observed": "2016-05-02T13:40:17Z",
|
|
"last_observed": "2016-05-02T13:40:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c1-ffec-466f-907b-433202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c1-ffec-466f-907b-433202de0b81",
|
|
"value": "https://www.virustotal.com/file/2fd28b285bfe748a61c8b3523960c705d5be81e51abed335e47f6a7728f3a923/analysis/1349822602/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c2-9c4c-4533-b47f-4a2102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:18.000Z",
|
|
"modified": "2016-05-02T13:40:18.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: eccc160b9e5a2caf4437896dd04bf6f6",
|
|
"pattern": "[file:hashes.SHA256 = '218e231239ef9699dbdc06a171cf1e2a022385734af56f753652ad70aa2559ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c2-3c98-437f-8c81-486c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:18.000Z",
|
|
"modified": "2016-05-02T13:40:18.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: eccc160b9e5a2caf4437896dd04bf6f6",
|
|
"pattern": "[file:hashes.SHA1 = '233bd1ec4732108a24b8f8d0c2ae0ca57d87eb51']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c2-0e24-4f8d-8982-4bb202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:18.000Z",
|
|
"modified": "2016-05-02T13:40:18.000Z",
|
|
"first_observed": "2016-05-02T13:40:18Z",
|
|
"last_observed": "2016-05-02T13:40:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c2-0e24-4f8d-8982-4bb202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c2-0e24-4f8d-8982-4bb202de0b81",
|
|
"value": "https://www.virustotal.com/file/218e231239ef9699dbdc06a171cf1e2a022385734af56f753652ad70aa2559ca/analysis/1403844016/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c3-c6a4-4f27-b3a4-443402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:19.000Z",
|
|
"modified": "2016-05-02T13:40:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: eb7e6a84f018692ad6a1a58f530c14e0",
|
|
"pattern": "[file:hashes.SHA256 = '900ffa358108e30cca89a0741898e6fd2c2e414f42422f6940575b531b02ac09']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c3-b744-405d-b901-438802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:19.000Z",
|
|
"modified": "2016-05-02T13:40:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: eb7e6a84f018692ad6a1a58f530c14e0",
|
|
"pattern": "[file:hashes.SHA1 = 'dca8197a7c76db42a7c0f764bc0382cb0055b2cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c4-5438-479d-ba4f-49e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:20.000Z",
|
|
"modified": "2016-05-02T13:40:20.000Z",
|
|
"first_observed": "2016-05-02T13:40:20Z",
|
|
"last_observed": "2016-05-02T13:40:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c4-5438-479d-ba4f-49e202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c4-5438-479d-ba4f-49e202de0b81",
|
|
"value": "https://www.virustotal.com/file/900ffa358108e30cca89a0741898e6fd2c2e414f42422f6940575b531b02ac09/analysis/1349564192/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c4-abf4-4ab8-9faf-43ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:20.000Z",
|
|
"modified": "2016-05-02T13:40:20.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e9d468c72e9ffa3962d09abd0c586772",
|
|
"pattern": "[file:hashes.SHA256 = '673c38226e4bcd26cc581f575ff6887751bb5ee3e1613db102369c3997a0b7c7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c4-75b8-47ec-b330-454302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:20.000Z",
|
|
"modified": "2016-05-02T13:40:20.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e9d468c72e9ffa3962d09abd0c586772",
|
|
"pattern": "[file:hashes.SHA1 = '2b5bacc52f47863eecb11c71c3bf068ba5910f0d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c5-fa50-4d2a-95c9-402b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:21.000Z",
|
|
"modified": "2016-05-02T13:40:21.000Z",
|
|
"first_observed": "2016-05-02T13:40:21Z",
|
|
"last_observed": "2016-05-02T13:40:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c5-fa50-4d2a-95c9-402b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c5-fa50-4d2a-95c9-402b02de0b81",
|
|
"value": "https://www.virustotal.com/file/673c38226e4bcd26cc581f575ff6887751bb5ee3e1613db102369c3997a0b7c7/analysis/1358082813/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c5-44d4-487c-bfeb-466a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:21.000Z",
|
|
"modified": "2016-05-02T13:40:21.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e99dd650695b19b7eb57868ee4251052",
|
|
"pattern": "[file:hashes.SHA256 = '941a7bd365e8362bcac094fd4d7e6a6da3876e714ab4aa8619d841cb229e9ebc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c6-23cc-45b8-905f-456702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:22.000Z",
|
|
"modified": "2016-05-02T13:40:22.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e99dd650695b19b7eb57868ee4251052",
|
|
"pattern": "[file:hashes.SHA1 = '20ce1e28473d63d02105ab83fa2895fb39837dbf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c6-cbf0-4ced-b08f-487902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:22.000Z",
|
|
"modified": "2016-05-02T13:40:22.000Z",
|
|
"first_observed": "2016-05-02T13:40:22Z",
|
|
"last_observed": "2016-05-02T13:40:22Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c6-cbf0-4ced-b08f-487902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c6-cbf0-4ced-b08f-487902de0b81",
|
|
"value": "https://www.virustotal.com/file/941a7bd365e8362bcac094fd4d7e6a6da3876e714ab4aa8619d841cb229e9ebc/analysis/1403691210/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c6-2940-4ead-b7b3-4dd102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:22.000Z",
|
|
"modified": "2016-05-02T13:40:22.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e9117eda1f943c53a02942d2e7039fb2",
|
|
"pattern": "[file:hashes.SHA256 = '5fc27302e94bceeaf0c906908bca2f68f0ab16e17072b236b669d38af568489d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c7-c090-48f7-a3c3-429802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:23.000Z",
|
|
"modified": "2016-05-02T13:40:23.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e9117eda1f943c53a02942d2e7039fb2",
|
|
"pattern": "[file:hashes.SHA1 = 'cdcbeb3259fcdffeed32f489c668312169ee0405']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c7-d208-4153-b9a8-4dff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:23.000Z",
|
|
"modified": "2016-05-02T13:40:23.000Z",
|
|
"first_observed": "2016-05-02T13:40:23Z",
|
|
"last_observed": "2016-05-02T13:40:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c7-d208-4153-b9a8-4dff02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c7-d208-4153-b9a8-4dff02de0b81",
|
|
"value": "https://www.virustotal.com/file/5fc27302e94bceeaf0c906908bca2f68f0ab16e17072b236b669d38af568489d/analysis/1455462679/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c8-ed40-4950-9e3a-4b1c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:24.000Z",
|
|
"modified": "2016-05-02T13:40:24.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e88599c90a6884cd8341975e60ab6db9",
|
|
"pattern": "[file:hashes.SHA256 = '084c5c5d2b9996cb5acfcdce9143a14c4c8cfd738ffbaf02469fa0c09abdf552']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c8-67b8-4ee8-bbf5-46b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:24.000Z",
|
|
"modified": "2016-05-02T13:40:24.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e88599c90a6884cd8341975e60ab6db9",
|
|
"pattern": "[file:hashes.SHA1 = '98de32c8b48287ff48b4aa4aa67e6df63f56b52a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758c9-8eb4-4c51-9494-42ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:25.000Z",
|
|
"modified": "2016-05-02T13:40:25.000Z",
|
|
"first_observed": "2016-05-02T13:40:25Z",
|
|
"last_observed": "2016-05-02T13:40:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758c9-8eb4-4c51-9494-42ec02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758c9-8eb4-4c51-9494-42ec02de0b81",
|
|
"value": "https://www.virustotal.com/file/084c5c5d2b9996cb5acfcdce9143a14c4c8cfd738ffbaf02469fa0c09abdf552/analysis/1412074428/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c9-11dc-47bd-87e4-474b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:25.000Z",
|
|
"modified": "2016-05-02T13:40:25.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e6a5b2f98260f707d237bbc0a9f451c8",
|
|
"pattern": "[file:hashes.SHA256 = '9fa5d774a6b3a54755afe6f43297987ab0185795cf7b1d512c11bf3f3c5b6016']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758c9-ea04-492a-82df-44ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:25.000Z",
|
|
"modified": "2016-05-02T13:40:25.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e6a5b2f98260f707d237bbc0a9f451c8",
|
|
"pattern": "[file:hashes.SHA1 = '6d1e5771564bebbec6a240b88a803a268bb244e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ca-a614-4205-b2b6-490702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:26.000Z",
|
|
"modified": "2016-05-02T13:40:26.000Z",
|
|
"first_observed": "2016-05-02T13:40:26Z",
|
|
"last_observed": "2016-05-02T13:40:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ca-a614-4205-b2b6-490702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ca-a614-4205-b2b6-490702de0b81",
|
|
"value": "https://www.virustotal.com/file/9fa5d774a6b3a54755afe6f43297987ab0185795cf7b1d512c11bf3f3c5b6016/analysis/1376139831/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ca-2648-4e1a-a2cb-4ac602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:26.000Z",
|
|
"modified": "2016-05-02T13:40:26.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e64ceb2c9b2c8ba8709a139f6ba27ff6",
|
|
"pattern": "[file:hashes.SHA256 = '55c29dc2be5c681e7f1e6fdc1a46eaa7a3ba711820e9620707f8f41874cb0751']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cb-b6b4-4f13-a332-471b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:27.000Z",
|
|
"modified": "2016-05-02T13:40:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e64ceb2c9b2c8ba8709a139f6ba27ff6",
|
|
"pattern": "[file:hashes.SHA1 = '3883ab94c0c4cc8bfe31ef0a3c0ab390143ac43a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758cb-e644-4b6f-a3ad-465b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:27.000Z",
|
|
"modified": "2016-05-02T13:40:27.000Z",
|
|
"first_observed": "2016-05-02T13:40:27Z",
|
|
"last_observed": "2016-05-02T13:40:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758cb-e644-4b6f-a3ad-465b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758cb-e644-4b6f-a3ad-465b02de0b81",
|
|
"value": "https://www.virustotal.com/file/55c29dc2be5c681e7f1e6fdc1a46eaa7a3ba711820e9620707f8f41874cb0751/analysis/1458288764/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cb-0d58-45e0-a486-40ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:27.000Z",
|
|
"modified": "2016-05-02T13:40:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e2f6adfa24b9750746cdae6ee15b3b56",
|
|
"pattern": "[file:hashes.SHA256 = '09973419f24f0fd11277107e0c390519cc80d71f742e4d9910c6d53947c24aa0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cc-cd10-4dc4-a60f-4f0c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:28.000Z",
|
|
"modified": "2016-05-02T13:40:28.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e2f6adfa24b9750746cdae6ee15b3b56",
|
|
"pattern": "[file:hashes.SHA1 = '7cd501b1e1c7c0e9bc30a4d5517180a477cfdb76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758cc-7be8-469b-8243-4d5302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:28.000Z",
|
|
"modified": "2016-05-02T13:40:28.000Z",
|
|
"first_observed": "2016-05-02T13:40:28Z",
|
|
"last_observed": "2016-05-02T13:40:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758cc-7be8-469b-8243-4d5302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758cc-7be8-469b-8243-4d5302de0b81",
|
|
"value": "https://www.virustotal.com/file/09973419f24f0fd11277107e0c390519cc80d71f742e4d9910c6d53947c24aa0/analysis/1425987680/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cc-a87c-4cf1-862b-41e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:28.000Z",
|
|
"modified": "2016-05-02T13:40:28.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e019892328a1dc5a952d8fec4280863b",
|
|
"pattern": "[file:hashes.SHA256 = 'f0f53922bc3ef301154495f655a4e4b38cf487ff566ae161b3b49a0b628f1b75']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cd-c0a0-4095-936c-4c9802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:29.000Z",
|
|
"modified": "2016-05-02T13:40:29.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: e019892328a1dc5a952d8fec4280863b",
|
|
"pattern": "[file:hashes.SHA1 = 'c0e68efd459714e3eb29c4c7a7d4afc06b1683eb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758cd-514c-4c4c-bed8-4df402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:29.000Z",
|
|
"modified": "2016-05-02T13:40:29.000Z",
|
|
"first_observed": "2016-05-02T13:40:29Z",
|
|
"last_observed": "2016-05-02T13:40:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758cd-514c-4c4c-bed8-4df402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758cd-514c-4c4c-bed8-4df402de0b81",
|
|
"value": "https://www.virustotal.com/file/f0f53922bc3ef301154495f655a4e4b38cf487ff566ae161b3b49a0b628f1b75/analysis/1359771335/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ce-b4c0-4acf-b422-408a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:30.000Z",
|
|
"modified": "2016-05-02T13:40:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ded4f175d84044c10fe1d3a629918f67",
|
|
"pattern": "[file:hashes.SHA256 = '80db0d84af22a0b3d683072ae4e53493a1ecc493b1bc5bf1572f5adb4ef06e1f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ce-d270-43c1-8bb7-4add02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:30.000Z",
|
|
"modified": "2016-05-02T13:40:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ded4f175d84044c10fe1d3a629918f67",
|
|
"pattern": "[file:hashes.SHA1 = 'd88f4f36f77b40da7ba6c2ea627f33742c72358a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758cf-4060-4209-9b2d-4c7a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:31.000Z",
|
|
"modified": "2016-05-02T13:40:31.000Z",
|
|
"first_observed": "2016-05-02T13:40:31Z",
|
|
"last_observed": "2016-05-02T13:40:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758cf-4060-4209-9b2d-4c7a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758cf-4060-4209-9b2d-4c7a02de0b81",
|
|
"value": "https://www.virustotal.com/file/80db0d84af22a0b3d683072ae4e53493a1ecc493b1bc5bf1572f5adb4ef06e1f/analysis/1460095100/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cf-bfb4-42d8-a52f-446302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:31.000Z",
|
|
"modified": "2016-05-02T13:40:31.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dcce201e25afac6f0d8ac5bf1b2ebcaf",
|
|
"pattern": "[file:hashes.SHA256 = 'c012d0b2d99f27640d6944a6d27c44a5274cb6542628fe08f3198a272f232b95']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758cf-b0dc-4b49-a903-4f2302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:31.000Z",
|
|
"modified": "2016-05-02T13:40:31.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dcce201e25afac6f0d8ac5bf1b2ebcaf",
|
|
"pattern": "[file:hashes.SHA1 = '2aa2ae3d2764490f2a9bfbb1b4f11797ccc9ac79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d0-d41c-4d85-b968-467702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:32.000Z",
|
|
"modified": "2016-05-02T13:40:32.000Z",
|
|
"first_observed": "2016-05-02T13:40:32Z",
|
|
"last_observed": "2016-05-02T13:40:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d0-d41c-4d85-b968-467702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d0-d41c-4d85-b968-467702de0b81",
|
|
"value": "https://www.virustotal.com/file/c012d0b2d99f27640d6944a6d27c44a5274cb6542628fe08f3198a272f232b95/analysis/1346588857/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d0-24b4-492c-ad3c-471502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:32.000Z",
|
|
"modified": "2016-05-02T13:40:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dc7d20a327c20c75b9e2cd45adc5aee5",
|
|
"pattern": "[file:hashes.SHA256 = 'b7f291019b2e8525916703fd0e278c820700c021d676e6ac7b1518cfbdd2b0fe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d1-5988-4031-a2da-40af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:33.000Z",
|
|
"modified": "2016-05-02T13:40:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dc7d20a327c20c75b9e2cd45adc5aee5",
|
|
"pattern": "[file:hashes.SHA1 = '55f5af790957e869aabb32b69d57912e3057a793']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d1-fcfc-4195-8429-412202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:33.000Z",
|
|
"modified": "2016-05-02T13:40:33.000Z",
|
|
"first_observed": "2016-05-02T13:40:33Z",
|
|
"last_observed": "2016-05-02T13:40:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d1-fcfc-4195-8429-412202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d1-fcfc-4195-8429-412202de0b81",
|
|
"value": "https://www.virustotal.com/file/b7f291019b2e8525916703fd0e278c820700c021d676e6ac7b1518cfbdd2b0fe/analysis/1362643291/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d1-20e8-433d-bd01-4c3b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:33.000Z",
|
|
"modified": "2016-05-02T13:40:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dbc1bed3a44619c834b6b22bba46b20c",
|
|
"pattern": "[file:hashes.SHA256 = '32a4d88da9d311fa45730649b49e38a04c93f8eb2353da97c9ba792045335240']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d2-679c-44a7-9122-447702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:34.000Z",
|
|
"modified": "2016-05-02T13:40:34.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: dbc1bed3a44619c834b6b22bba46b20c",
|
|
"pattern": "[file:hashes.SHA1 = '7fad663f081f7864507fa73b15b6338f7d5f611d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d2-5bac-4567-bea8-402a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:34.000Z",
|
|
"modified": "2016-05-02T13:40:34.000Z",
|
|
"first_observed": "2016-05-02T13:40:34Z",
|
|
"last_observed": "2016-05-02T13:40:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d2-5bac-4567-bea8-402a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d2-5bac-4567-bea8-402a02de0b81",
|
|
"value": "https://www.virustotal.com/file/32a4d88da9d311fa45730649b49e38a04c93f8eb2353da97c9ba792045335240/analysis/1362161316/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d3-03d4-48ed-9d49-423402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:35.000Z",
|
|
"modified": "2016-05-02T13:40:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d9da6c95fb6a5cbefb2fcac169c61b59",
|
|
"pattern": "[file:hashes.SHA256 = '3d257fa59aa3cd530668da3a2eebb72691f0015dd3ee8d367d2bc92221da2700']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d3-5a2c-4592-8440-4a1702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:35.000Z",
|
|
"modified": "2016-05-02T13:40:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d9da6c95fb6a5cbefb2fcac169c61b59",
|
|
"pattern": "[file:hashes.SHA1 = 'a75fe854a5c89d974904ff9d98efde0ccb99804a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d3-fa1c-4a06-892e-419b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:35.000Z",
|
|
"modified": "2016-05-02T13:40:35.000Z",
|
|
"first_observed": "2016-05-02T13:40:35Z",
|
|
"last_observed": "2016-05-02T13:40:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d3-fa1c-4a06-892e-419b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d3-fa1c-4a06-892e-419b02de0b81",
|
|
"value": "https://www.virustotal.com/file/3d257fa59aa3cd530668da3a2eebb72691f0015dd3ee8d367d2bc92221da2700/analysis/1444322939/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d4-5a54-4651-8fa8-4e4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:36.000Z",
|
|
"modified": "2016-05-02T13:40:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d89d3297c9c310e3cdc67f92d8585025",
|
|
"pattern": "[file:hashes.SHA256 = 'acbbf1e7d21ccf547470bca6e148f4493dc0db68df4c8bcb70d8dee490485a65']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d4-22ec-43f2-bebf-4fcb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:36.000Z",
|
|
"modified": "2016-05-02T13:40:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d89d3297c9c310e3cdc67f92d8585025",
|
|
"pattern": "[file:hashes.SHA1 = '2d83436163cbe7e7221d8b98b7284ba6dd6495a7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d5-8478-447e-9272-4d2f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:37.000Z",
|
|
"modified": "2016-05-02T13:40:37.000Z",
|
|
"first_observed": "2016-05-02T13:40:37Z",
|
|
"last_observed": "2016-05-02T13:40:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d5-8478-447e-9272-4d2f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d5-8478-447e-9272-4d2f02de0b81",
|
|
"value": "https://www.virustotal.com/file/acbbf1e7d21ccf547470bca6e148f4493dc0db68df4c8bcb70d8dee490485a65/analysis/1361549242/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d5-1df8-46b5-bf94-428002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:37.000Z",
|
|
"modified": "2016-05-02T13:40:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d78149cd7ee8a37ced029d168ed776e9",
|
|
"pattern": "[file:hashes.SHA256 = '02c24c06e0cea6e8560d1943ff53bef38aacc1abe12d43637881a2bb285c9f83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d6-8ec0-445d-b1ca-4c3102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:38.000Z",
|
|
"modified": "2016-05-02T13:40:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d78149cd7ee8a37ced029d168ed776e9",
|
|
"pattern": "[file:hashes.SHA1 = 'de11b89e8eaec6bbe593d740969a5fc1eca73492']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d6-0b64-44d1-985f-48b002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:38.000Z",
|
|
"modified": "2016-05-02T13:40:38.000Z",
|
|
"first_observed": "2016-05-02T13:40:38Z",
|
|
"last_observed": "2016-05-02T13:40:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d6-0b64-44d1-985f-48b002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d6-0b64-44d1-985f-48b002de0b81",
|
|
"value": "https://www.virustotal.com/file/02c24c06e0cea6e8560d1943ff53bef38aacc1abe12d43637881a2bb285c9f83/analysis/1446022620/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d6-102c-415e-a7cb-4b8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:38.000Z",
|
|
"modified": "2016-05-02T13:40:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d718e6a861fc74cd47626fdb5dd8559a",
|
|
"pattern": "[file:hashes.SHA256 = '2cc596388f6f8e1f2d42bf5e39e17513035be983310fbd2e81b1ff332dee10d7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d7-f790-457b-8e95-468d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:39.000Z",
|
|
"modified": "2016-05-02T13:40:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d718e6a861fc74cd47626fdb5dd8559a",
|
|
"pattern": "[file:hashes.SHA1 = '97638666ab61edf0ee78a3bde2cd2caf4b7899f5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d7-529c-497c-aff1-47f402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:39.000Z",
|
|
"modified": "2016-05-02T13:40:39.000Z",
|
|
"first_observed": "2016-05-02T13:40:39Z",
|
|
"last_observed": "2016-05-02T13:40:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d7-529c-497c-aff1-47f402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d7-529c-497c-aff1-47f402de0b81",
|
|
"value": "https://www.virustotal.com/file/2cc596388f6f8e1f2d42bf5e39e17513035be983310fbd2e81b1ff332dee10d7/analysis/1444933582/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d8-3ffc-43ba-83b2-407c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:40.000Z",
|
|
"modified": "2016-05-02T13:40:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d2bad8e2f9c5c813c1ab4c76ba9f9ab6",
|
|
"pattern": "[file:hashes.SHA256 = '6754a449879219de37bb29027f90c17ceacb5072c0774a0f3cd6579909b7f2e5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d8-5a28-4975-b09c-4e9c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:40.000Z",
|
|
"modified": "2016-05-02T13:40:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d2bad8e2f9c5c813c1ab4c76ba9f9ab6",
|
|
"pattern": "[file:hashes.SHA1 = 'c8de67fa324fd7fe22c1805c34039d7f29765d87']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758d8-41a8-4231-b4d5-4a7302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:40.000Z",
|
|
"modified": "2016-05-02T13:40:40.000Z",
|
|
"first_observed": "2016-05-02T13:40:40Z",
|
|
"last_observed": "2016-05-02T13:40:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758d8-41a8-4231-b4d5-4a7302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758d8-41a8-4231-b4d5-4a7302de0b81",
|
|
"value": "https://www.virustotal.com/file/6754a449879219de37bb29027f90c17ceacb5072c0774a0f3cd6579909b7f2e5/analysis/1399704866/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d9-f538-4f90-9a98-452102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:41.000Z",
|
|
"modified": "2016-05-02T13:40:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d1a25ebf70a88fd76c3a7501733f1e24",
|
|
"pattern": "[file:hashes.SHA256 = 'c1e4096ec911822a11c30d41e940cbac483da4c5bf7bbc3ddb302c2e46b31ca4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758d9-18e8-4d01-a271-4e2f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:41.000Z",
|
|
"modified": "2016-05-02T13:40:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d1a25ebf70a88fd76c3a7501733f1e24",
|
|
"pattern": "[file:hashes.SHA1 = '927b1556101a4b55a348535aa78c58636e031746']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758da-9c78-4407-acf2-4d6f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:42.000Z",
|
|
"modified": "2016-05-02T13:40:42.000Z",
|
|
"first_observed": "2016-05-02T13:40:42Z",
|
|
"last_observed": "2016-05-02T13:40:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758da-9c78-4407-acf2-4d6f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758da-9c78-4407-acf2-4d6f02de0b81",
|
|
"value": "https://www.virustotal.com/file/c1e4096ec911822a11c30d41e940cbac483da4c5bf7bbc3ddb302c2e46b31ca4/analysis/1445137796/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758da-cfe0-4c72-b305-4eea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:42.000Z",
|
|
"modified": "2016-05-02T13:40:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d101106f8551a38eb9a11fc1da903a67",
|
|
"pattern": "[file:hashes.SHA256 = '73484c371cdf63eb288c093f5e75f16b997ccea03884659a84aebf877e6d138c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758da-05d0-4e42-a65a-491802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:42.000Z",
|
|
"modified": "2016-05-02T13:40:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: d101106f8551a38eb9a11fc1da903a67",
|
|
"pattern": "[file:hashes.SHA1 = '52e3a187e51ed86910846b170e7e3abb2ff25511']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758db-e500-46a4-af07-497102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:43.000Z",
|
|
"modified": "2016-05-02T13:40:43.000Z",
|
|
"first_observed": "2016-05-02T13:40:43Z",
|
|
"last_observed": "2016-05-02T13:40:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758db-e500-46a4-af07-497102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758db-e500-46a4-af07-497102de0b81",
|
|
"value": "https://www.virustotal.com/file/73484c371cdf63eb288c093f5e75f16b997ccea03884659a84aebf877e6d138c/analysis/1368237962/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758db-3f38-443a-8d3f-478b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:43.000Z",
|
|
"modified": "2016-05-02T13:40:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: cdcb1bf7a92c206be4f2f8493424f97b",
|
|
"pattern": "[file:hashes.SHA256 = '707424d969a1692a42a1538fb5777ae00dccbe81f9e0255d89059110112eb330']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758dc-56f8-4589-81ce-454202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:44.000Z",
|
|
"modified": "2016-05-02T13:40:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: cdcb1bf7a92c206be4f2f8493424f97b",
|
|
"pattern": "[file:hashes.SHA1 = '2174dd2d15122a6354f132727c96eae98f01eb59']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758dc-e1e0-468f-85bb-4be102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:44.000Z",
|
|
"modified": "2016-05-02T13:40:44.000Z",
|
|
"first_observed": "2016-05-02T13:40:44Z",
|
|
"last_observed": "2016-05-02T13:40:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758dc-e1e0-468f-85bb-4be102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758dc-e1e0-468f-85bb-4be102de0b81",
|
|
"value": "https://www.virustotal.com/file/707424d969a1692a42a1538fb5777ae00dccbe81f9e0255d89059110112eb330/analysis/1452989598/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758dc-0b20-4e39-866e-4b3b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:44.000Z",
|
|
"modified": "2016-05-02T13:40:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: cb635b1ff7443252cf3686a5a8c40efa",
|
|
"pattern": "[file:hashes.SHA256 = 'd4799ba68cfe5717471802a75e510319f7576d830ec5260c03df8357dad24b84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758dd-8610-469d-b47c-449102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:45.000Z",
|
|
"modified": "2016-05-02T13:40:45.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: cb635b1ff7443252cf3686a5a8c40efa",
|
|
"pattern": "[file:hashes.SHA1 = 'e0db31b0fd905612f3c18d60a78a15cc90b4e5ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758dd-e468-4f64-b935-43a702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:45.000Z",
|
|
"modified": "2016-05-02T13:40:45.000Z",
|
|
"first_observed": "2016-05-02T13:40:45Z",
|
|
"last_observed": "2016-05-02T13:40:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758dd-e468-4f64-b935-43a702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758dd-e468-4f64-b935-43a702de0b81",
|
|
"value": "https://www.virustotal.com/file/d4799ba68cfe5717471802a75e510319f7576d830ec5260c03df8357dad24b84/analysis/1399276213/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758de-bb20-4db7-8bdb-401b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:46.000Z",
|
|
"modified": "2016-05-02T13:40:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c6f27fe0ba7a877fecdc6227454d052f",
|
|
"pattern": "[file:hashes.SHA256 = '261edf4728158155643b690989eddd9fb30794342525b6899d6840688abbac2f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758de-5854-484f-a4cd-484e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:46.000Z",
|
|
"modified": "2016-05-02T13:40:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c6f27fe0ba7a877fecdc6227454d052f",
|
|
"pattern": "[file:hashes.SHA1 = '9411b8cc6c657a41148842f6a007b45d17faedfd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758df-4d08-4db1-92da-437902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:46.000Z",
|
|
"modified": "2016-05-02T13:40:46.000Z",
|
|
"first_observed": "2016-05-02T13:40:46Z",
|
|
"last_observed": "2016-05-02T13:40:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758df-4d08-4db1-92da-437902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758df-4d08-4db1-92da-437902de0b81",
|
|
"value": "https://www.virustotal.com/file/261edf4728158155643b690989eddd9fb30794342525b6899d6840688abbac2f/analysis/1458288737/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758df-9380-4c3f-85a4-440d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:47.000Z",
|
|
"modified": "2016-05-02T13:40:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c60abc691aeb768b73509886bec89e6d",
|
|
"pattern": "[file:hashes.SHA256 = '81ae73042a394ca2821474be26ea40e47bf8187f6163c880fb0bb4273564fe5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758df-b4a8-4aa4-af14-4a6402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:47.000Z",
|
|
"modified": "2016-05-02T13:40:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c60abc691aeb768b73509886bec89e6d",
|
|
"pattern": "[file:hashes.SHA1 = 'b1517bbd39906e2260120f041600aaa39746d373']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e0-120c-45bd-8ff7-411d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:48.000Z",
|
|
"modified": "2016-05-02T13:40:48.000Z",
|
|
"first_observed": "2016-05-02T13:40:48Z",
|
|
"last_observed": "2016-05-02T13:40:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e0-120c-45bd-8ff7-411d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e0-120c-45bd-8ff7-411d02de0b81",
|
|
"value": "https://www.virustotal.com/file/81ae73042a394ca2821474be26ea40e47bf8187f6163c880fb0bb4273564fe5f/analysis/1362376270/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e0-cdc8-43f5-8428-459d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:48.000Z",
|
|
"modified": "2016-05-02T13:40:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c5eeae78cb820186f5f1acad6f1039af",
|
|
"pattern": "[file:hashes.SHA256 = 'adf01c61ab6936aded1ad97006697d3ec036059cdd07f3d4e0ef31a47a1db072']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e0-09f0-48ed-a939-415c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:48.000Z",
|
|
"modified": "2016-05-02T13:40:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c5eeae78cb820186f5f1acad6f1039af",
|
|
"pattern": "[file:hashes.SHA1 = 'fa8d703f9335a96e9d2edbff60995fa51c315bb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e1-553c-4525-9cec-4bcd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:49.000Z",
|
|
"modified": "2016-05-02T13:40:49.000Z",
|
|
"first_observed": "2016-05-02T13:40:49Z",
|
|
"last_observed": "2016-05-02T13:40:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e1-553c-4525-9cec-4bcd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e1-553c-4525-9cec-4bcd02de0b81",
|
|
"value": "https://www.virustotal.com/file/adf01c61ab6936aded1ad97006697d3ec036059cdd07f3d4e0ef31a47a1db072/analysis/1390804709/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e1-5640-4c51-8471-436702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:49.000Z",
|
|
"modified": "2016-05-02T13:40:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c4d8b12a70cf01df681712f1a2ddf0fb",
|
|
"pattern": "[file:hashes.SHA256 = 'a2dc8c1327a184013f1e188258813776e052ac7a68c96c058a723cac28c97bdd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e2-cb30-4bdf-9869-475b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:50.000Z",
|
|
"modified": "2016-05-02T13:40:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c4d8b12a70cf01df681712f1a2ddf0fb",
|
|
"pattern": "[file:hashes.SHA1 = '5eb213f81f7e7495299a1de39deb46fdd82393c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e2-50bc-4286-acc2-4ad602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:50.000Z",
|
|
"modified": "2016-05-02T13:40:50.000Z",
|
|
"first_observed": "2016-05-02T13:40:50Z",
|
|
"last_observed": "2016-05-02T13:40:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e2-50bc-4286-acc2-4ad602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e2-50bc-4286-acc2-4ad602de0b81",
|
|
"value": "https://www.virustotal.com/file/a2dc8c1327a184013f1e188258813776e052ac7a68c96c058a723cac28c97bdd/analysis/1448102849/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e2-baa4-4788-97f5-442c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:50.000Z",
|
|
"modified": "2016-05-02T13:40:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c4c1c7722cfdf5ecc66b387dd4a37405",
|
|
"pattern": "[file:hashes.SHA256 = '28ee74206486aca2d8fe7a372868fde891f143066677ccb57a53254a9e829b0c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e3-58b8-4a87-ad7b-40cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:51.000Z",
|
|
"modified": "2016-05-02T13:40:51.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c4c1c7722cfdf5ecc66b387dd4a37405",
|
|
"pattern": "[file:hashes.SHA1 = 'edbc601e2884b2b1c42f315964269c6c36b75aab']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e3-61c4-41f8-89e7-472d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:51.000Z",
|
|
"modified": "2016-05-02T13:40:51.000Z",
|
|
"first_observed": "2016-05-02T13:40:51Z",
|
|
"last_observed": "2016-05-02T13:40:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e3-61c4-41f8-89e7-472d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e3-61c4-41f8-89e7-472d02de0b81",
|
|
"value": "https://www.virustotal.com/file/28ee74206486aca2d8fe7a372868fde891f143066677ccb57a53254a9e829b0c/analysis/1362214802/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e4-675c-4879-9fd9-454502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:52.000Z",
|
|
"modified": "2016-05-02T13:40:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c30614492d31e60511fb8b28fea653ef",
|
|
"pattern": "[file:hashes.SHA256 = '9fffe4bcc75a6dbd76936c2f4e363de9b16b14e40b464dbb6e7770b710a09ae3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e4-3a04-490d-a4bf-43f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:52.000Z",
|
|
"modified": "2016-05-02T13:40:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c30614492d31e60511fb8b28fea653ef",
|
|
"pattern": "[file:hashes.SHA1 = '0125b7715668fd2ed94c5ffb4c76456cee6886ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e4-d06c-41a8-869f-4ddb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:52.000Z",
|
|
"modified": "2016-05-02T13:40:52.000Z",
|
|
"first_observed": "2016-05-02T13:40:52Z",
|
|
"last_observed": "2016-05-02T13:40:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e4-d06c-41a8-869f-4ddb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e4-d06c-41a8-869f-4ddb02de0b81",
|
|
"value": "https://www.virustotal.com/file/9fffe4bcc75a6dbd76936c2f4e363de9b16b14e40b464dbb6e7770b710a09ae3/analysis/1451237712/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e5-e31c-4208-81c4-43e802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:53.000Z",
|
|
"modified": "2016-05-02T13:40:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c1a7bd517cfc88c17176a65e82a5bea9",
|
|
"pattern": "[file:hashes.SHA256 = 'bbdbafb5e1ecadf106ab873528ce5e0df02855348f3d74f6e12d747b46ea8fdc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e5-9a0c-4fc7-93d9-4e3902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:53.000Z",
|
|
"modified": "2016-05-02T13:40:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: c1a7bd517cfc88c17176a65e82a5bea9",
|
|
"pattern": "[file:hashes.SHA1 = '97298cf00f6324bc7b12d650b017a32d859da112']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e6-d29c-4f7b-8150-4a7102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:54.000Z",
|
|
"modified": "2016-05-02T13:40:54.000Z",
|
|
"first_observed": "2016-05-02T13:40:54Z",
|
|
"last_observed": "2016-05-02T13:40:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e6-d29c-4f7b-8150-4a7102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e6-d29c-4f7b-8150-4a7102de0b81",
|
|
"value": "https://www.virustotal.com/file/bbdbafb5e1ecadf106ab873528ce5e0df02855348f3d74f6e12d747b46ea8fdc/analysis/1362372976/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e6-c6d8-4425-b91b-498c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:54.000Z",
|
|
"modified": "2016-05-02T13:40:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bd5c838a2f00dd5fd9ab9ebe0cb2528e",
|
|
"pattern": "[file:hashes.SHA256 = '221036464af27e1661c056d22705fbca407ca24a0e44a3dc8e37bf01f16a5f40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e6-33c0-4c1b-b2ab-4f4802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:54.000Z",
|
|
"modified": "2016-05-02T13:40:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bd5c838a2f00dd5fd9ab9ebe0cb2528e",
|
|
"pattern": "[file:hashes.SHA1 = 'f30113c3c82d55dcc11302fdd5dddd428c94ea1b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e7-2d4c-4ceb-a7c2-4ad002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:55.000Z",
|
|
"modified": "2016-05-02T13:40:55.000Z",
|
|
"first_observed": "2016-05-02T13:40:55Z",
|
|
"last_observed": "2016-05-02T13:40:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e7-2d4c-4ceb-a7c2-4ad002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e7-2d4c-4ceb-a7c2-4ad002de0b81",
|
|
"value": "https://www.virustotal.com/file/221036464af27e1661c056d22705fbca407ca24a0e44a3dc8e37bf01f16a5f40/analysis/1459760998/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e7-3c2c-41f8-bdf2-4ccc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:55.000Z",
|
|
"modified": "2016-05-02T13:40:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bd3c5fb34f164df13eeaa75aae16eff4",
|
|
"pattern": "[file:hashes.SHA256 = '0104e09acbfd9354796eda63d1400c83f6d010eb82ec84414f0f1ae9204c8ebd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e7-2110-40b2-a9d1-4df602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:55.000Z",
|
|
"modified": "2016-05-02T13:40:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bd3c5fb34f164df13eeaa75aae16eff4",
|
|
"pattern": "[file:hashes.SHA1 = 'fc65453c482f5b6f81516c04b09b62a54d98a77a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e8-f0d4-4ff9-8351-4f1202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:56.000Z",
|
|
"modified": "2016-05-02T13:40:56.000Z",
|
|
"first_observed": "2016-05-02T13:40:56Z",
|
|
"last_observed": "2016-05-02T13:40:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e8-f0d4-4ff9-8351-4f1202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e8-f0d4-4ff9-8351-4f1202de0b81",
|
|
"value": "https://www.virustotal.com/file/0104e09acbfd9354796eda63d1400c83f6d010eb82ec84414f0f1ae9204c8ebd/analysis/1376372828/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e8-342c-46bb-b12f-4c3c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:56.000Z",
|
|
"modified": "2016-05-02T13:40:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bc8c1f72d0813c281c9a1e4a3fb10f5e",
|
|
"pattern": "[file:hashes.SHA256 = '6c5871fb6364c10afa2c949714108818388e609308f087ee3b57fe82b9c2d10e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e8-c410-4b29-8824-455d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:56.000Z",
|
|
"modified": "2016-05-02T13:40:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bc8c1f72d0813c281c9a1e4a3fb10f5e",
|
|
"pattern": "[file:hashes.SHA1 = 'a7ccd49c70dea79a363ef7810830adbc352a1cdf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758e9-7ab0-4e7c-8be4-406602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:57.000Z",
|
|
"modified": "2016-05-02T13:40:57.000Z",
|
|
"first_observed": "2016-05-02T13:40:57Z",
|
|
"last_observed": "2016-05-02T13:40:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758e9-7ab0-4e7c-8be4-406602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758e9-7ab0-4e7c-8be4-406602de0b81",
|
|
"value": "https://www.virustotal.com/file/6c5871fb6364c10afa2c949714108818388e609308f087ee3b57fe82b9c2d10e/analysis/1416974228/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758e9-bda4-469b-9279-46d002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:57.000Z",
|
|
"modified": "2016-05-02T13:40:57.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bb8bff333eb1fb47b1b020b5696e00f3",
|
|
"pattern": "[file:hashes.SHA256 = 'bea197eda434d2cda4d5bac930ba6aa487e2fe447ba7e7c16726e5e74c011a38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ea-1aec-48eb-91cd-4a9802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:58.000Z",
|
|
"modified": "2016-05-02T13:40:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: bb8bff333eb1fb47b1b020b5696e00f3",
|
|
"pattern": "[file:hashes.SHA1 = 'e3094f7a0364c49b8fd52616d8931931bfbcce24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ea-4f3c-4c39-8012-489902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:58.000Z",
|
|
"modified": "2016-05-02T13:40:58.000Z",
|
|
"first_observed": "2016-05-02T13:40:58Z",
|
|
"last_observed": "2016-05-02T13:40:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ea-4f3c-4c39-8012-489902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ea-4f3c-4c39-8012-489902de0b81",
|
|
"value": "https://www.virustotal.com/file/bea197eda434d2cda4d5bac930ba6aa487e2fe447ba7e7c16726e5e74c011a38/analysis/1458288737/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ea-9ee8-48bf-8083-4a4002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:58.000Z",
|
|
"modified": "2016-05-02T13:40:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: baf685816ef9f71b85f2fd15df63be53",
|
|
"pattern": "[file:hashes.SHA256 = 'd0cf98c17a9235cc96e8fbbc6f2f7dd5adca60f73199c6afba010a635c1c2261']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758eb-b110-40fc-b7e1-482102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:58.000Z",
|
|
"modified": "2016-05-02T13:40:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: baf685816ef9f71b85f2fd15df63be53",
|
|
"pattern": "[file:hashes.SHA1 = 'd994f9ad0a4d8b398130e03565472621870d30aa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758eb-cc6c-4786-b56d-40a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:59.000Z",
|
|
"modified": "2016-05-02T13:40:59.000Z",
|
|
"first_observed": "2016-05-02T13:40:59Z",
|
|
"last_observed": "2016-05-02T13:40:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758eb-cc6c-4786-b56d-40a602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758eb-cc6c-4786-b56d-40a602de0b81",
|
|
"value": "https://www.virustotal.com/file/d0cf98c17a9235cc96e8fbbc6f2f7dd5adca60f73199c6afba010a635c1c2261/analysis/1374853680/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758eb-b774-4176-a5f0-4ea102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:40:59.000Z",
|
|
"modified": "2016-05-02T13:40:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b9c55a7acecc3509b057b34e0a749c88",
|
|
"pattern": "[file:hashes.SHA256 = 'dbf3b01e74b27a192053431f172342269c271b102c4225a82d85370d2aa127a1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:40:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ec-2860-48fb-9ed8-465402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:00.000Z",
|
|
"modified": "2016-05-02T13:41:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b9c55a7acecc3509b057b34e0a749c88",
|
|
"pattern": "[file:hashes.SHA1 = '4d311027ca838f7de9c39952552b9c14a8e379ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ec-0718-496c-82cc-455002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:00.000Z",
|
|
"modified": "2016-05-02T13:41:00.000Z",
|
|
"first_observed": "2016-05-02T13:41:00Z",
|
|
"last_observed": "2016-05-02T13:41:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ec-0718-496c-82cc-455002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ec-0718-496c-82cc-455002de0b81",
|
|
"value": "https://www.virustotal.com/file/dbf3b01e74b27a192053431f172342269c271b102c4225a82d85370d2aa127a1/analysis/1359889214/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ec-4ce8-43a6-b6ba-416302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:00.000Z",
|
|
"modified": "2016-05-02T13:41:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b985a36d00033365bfd9b39cc95242b9",
|
|
"pattern": "[file:hashes.SHA256 = '0cc9398fbf652b610b06de0abc40fa23b15baf8102e2c0be9719a89f7c2a82d5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ed-844c-4661-b3dd-465602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:01.000Z",
|
|
"modified": "2016-05-02T13:41:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b985a36d00033365bfd9b39cc95242b9",
|
|
"pattern": "[file:hashes.SHA1 = 'c786c55c49c15952fbddb8ffedecf2d853e13a15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ed-1b40-4735-a6aa-467802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:01.000Z",
|
|
"modified": "2016-05-02T13:41:01.000Z",
|
|
"first_observed": "2016-05-02T13:41:01Z",
|
|
"last_observed": "2016-05-02T13:41:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ed-1b40-4735-a6aa-467802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ed-1b40-4735-a6aa-467802de0b81",
|
|
"value": "https://www.virustotal.com/file/0cc9398fbf652b610b06de0abc40fa23b15baf8102e2c0be9719a89f7c2a82d5/analysis/1404382540/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ee-519c-485b-97fd-44c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:02.000Z",
|
|
"modified": "2016-05-02T13:41:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b74c6fbb8c0812797c726395b3bd812e",
|
|
"pattern": "[file:hashes.SHA256 = 'cb5219513c3eb3cf8aaf10676b7976db97370a843cdb58bb2fcc2391493257b2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ee-4904-4190-a1cc-494502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:02.000Z",
|
|
"modified": "2016-05-02T13:41:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b74c6fbb8c0812797c726395b3bd812e",
|
|
"pattern": "[file:hashes.SHA1 = 'ed329080905672127779ee83c29ea006cdd6b5da']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ee-70e4-4592-b7d1-4ccc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:02.000Z",
|
|
"modified": "2016-05-02T13:41:02.000Z",
|
|
"first_observed": "2016-05-02T13:41:02Z",
|
|
"last_observed": "2016-05-02T13:41:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ee-70e4-4592-b7d1-4ccc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ee-70e4-4592-b7d1-4ccc02de0b81",
|
|
"value": "https://www.virustotal.com/file/cb5219513c3eb3cf8aaf10676b7976db97370a843cdb58bb2fcc2391493257b2/analysis/1458288764/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ef-07b0-4030-83f0-436302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:03.000Z",
|
|
"modified": "2016-05-02T13:41:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b4b1d37845a5448ba394c751fc481d63",
|
|
"pattern": "[file:hashes.SHA256 = '12ab8e615eb8f2b531534e2724ebd34917539343b9f5b43d7c62860d19fb9954']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ef-d3a8-44ae-b01e-40fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:03.000Z",
|
|
"modified": "2016-05-02T13:41:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b4b1d37845a5448ba394c751fc481d63",
|
|
"pattern": "[file:hashes.SHA1 = '1d081cf7ce210060a3c385f08c27e8da19b4c660']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f0-1b90-4e23-a256-421f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:04.000Z",
|
|
"modified": "2016-05-02T13:41:04.000Z",
|
|
"first_observed": "2016-05-02T13:41:04Z",
|
|
"last_observed": "2016-05-02T13:41:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f0-1b90-4e23-a256-421f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f0-1b90-4e23-a256-421f02de0b81",
|
|
"value": "https://www.virustotal.com/file/12ab8e615eb8f2b531534e2724ebd34917539343b9f5b43d7c62860d19fb9954/analysis/1434217984/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f0-2dc8-4d9f-a405-4ec902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:04.000Z",
|
|
"modified": "2016-05-02T13:41:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b3cb5132f9f7f3225952e461d5a813e7",
|
|
"pattern": "[file:hashes.SHA256 = '333c5628a0c64983de606e9edab2c2d55a9cd81e49e2f30d8509077a8549ad54']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f0-5be4-4ebd-95b3-41e502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:04.000Z",
|
|
"modified": "2016-05-02T13:41:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b3cb5132f9f7f3225952e461d5a813e7",
|
|
"pattern": "[file:hashes.SHA1 = '54c11a9a43d4c2b5f8e4cd1f943f457ac106b779']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f1-5908-4870-a6c0-4eaa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:05.000Z",
|
|
"modified": "2016-05-02T13:41:05.000Z",
|
|
"first_observed": "2016-05-02T13:41:05Z",
|
|
"last_observed": "2016-05-02T13:41:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f1-5908-4870-a6c0-4eaa02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f1-5908-4870-a6c0-4eaa02de0b81",
|
|
"value": "https://www.virustotal.com/file/333c5628a0c64983de606e9edab2c2d55a9cd81e49e2f30d8509077a8549ad54/analysis/1362862504/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f1-484c-45a9-a46d-4a5702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:05.000Z",
|
|
"modified": "2016-05-02T13:41:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b2ef1ef6c9815385a0526de99a3a382b",
|
|
"pattern": "[file:hashes.SHA256 = '4ceebf61798f974a745a4cdd938595f09d457e6be9e38417730f8e7f964f8fb3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f2-0dd8-4e85-a6f3-44e902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:06.000Z",
|
|
"modified": "2016-05-02T13:41:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b2ef1ef6c9815385a0526de99a3a382b",
|
|
"pattern": "[file:hashes.SHA1 = 'af096b4157bf8592e7b14d50a3415f011529725f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f2-db7c-4f5b-a58e-4ec702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:06.000Z",
|
|
"modified": "2016-05-02T13:41:06.000Z",
|
|
"first_observed": "2016-05-02T13:41:06Z",
|
|
"last_observed": "2016-05-02T13:41:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f2-db7c-4f5b-a58e-4ec702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f2-db7c-4f5b-a58e-4ec702de0b81",
|
|
"value": "https://www.virustotal.com/file/4ceebf61798f974a745a4cdd938595f09d457e6be9e38417730f8e7f964f8fb3/analysis/1361048903/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f2-1354-443f-89d6-436d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:06.000Z",
|
|
"modified": "2016-05-02T13:41:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b15b59e56988d3a815a1c77b52689bf0",
|
|
"pattern": "[file:hashes.SHA256 = 'd444f8fe08a44bb3d8d490c726f07f775cdd69ff6b31d6d8124ebdeb57cdcdf8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f3-df20-4087-a8ef-441202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:07.000Z",
|
|
"modified": "2016-05-02T13:41:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b15b59e56988d3a815a1c77b52689bf0",
|
|
"pattern": "[file:hashes.SHA1 = '4febcf075f9ba0e2918b9ff3d48eed450cc953aa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f3-89c0-4f68-9acc-45d602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:07.000Z",
|
|
"modified": "2016-05-02T13:41:07.000Z",
|
|
"first_observed": "2016-05-02T13:41:07Z",
|
|
"last_observed": "2016-05-02T13:41:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f3-89c0-4f68-9acc-45d602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f3-89c0-4f68-9acc-45d602de0b81",
|
|
"value": "https://www.virustotal.com/file/d444f8fe08a44bb3d8d490c726f07f775cdd69ff6b31d6d8124ebdeb57cdcdf8/analysis/1374913148/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f4-b028-4d42-b087-4a6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:08.000Z",
|
|
"modified": "2016-05-02T13:41:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b07d49c1c9f6958b7a96b3c87e039cf2",
|
|
"pattern": "[file:hashes.SHA256 = '7fb6587de81992203d90ec6ad3f6efce4bf4cf3704b69844d29dd08baad928e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f4-14b0-49ac-b183-499c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:08.000Z",
|
|
"modified": "2016-05-02T13:41:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: b07d49c1c9f6958b7a96b3c87e039cf2",
|
|
"pattern": "[file:hashes.SHA1 = 'd7c781879479742e24b966a8ebc024c22ffc0813']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f4-1c54-4996-a37c-49e402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:08.000Z",
|
|
"modified": "2016-05-02T13:41:08.000Z",
|
|
"first_observed": "2016-05-02T13:41:08Z",
|
|
"last_observed": "2016-05-02T13:41:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f4-1c54-4996-a37c-49e402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f4-1c54-4996-a37c-49e402de0b81",
|
|
"value": "https://www.virustotal.com/file/7fb6587de81992203d90ec6ad3f6efce4bf4cf3704b69844d29dd08baad928e1/analysis/1361197854/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f5-ea6c-4d56-8ec4-4c8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:09.000Z",
|
|
"modified": "2016-05-02T13:41:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ad24c8c54e467d235faaa85f3a98a55a",
|
|
"pattern": "[file:hashes.SHA256 = 'b77123ec04d8818318a08cf317c5d47ee3b7679519de84eca9a6278aeb3da27e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f5-324c-4daa-a8b1-427802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:09.000Z",
|
|
"modified": "2016-05-02T13:41:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ad24c8c54e467d235faaa85f3a98a55a",
|
|
"pattern": "[file:hashes.SHA1 = 'f0f01315270b2c20ad0909f6c0fb1311394bfcb6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f6-bce0-49be-af23-4bfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:10.000Z",
|
|
"modified": "2016-05-02T13:41:10.000Z",
|
|
"first_observed": "2016-05-02T13:41:10Z",
|
|
"last_observed": "2016-05-02T13:41:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f6-bce0-49be-af23-4bfd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f6-bce0-49be-af23-4bfd02de0b81",
|
|
"value": "https://www.virustotal.com/file/b77123ec04d8818318a08cf317c5d47ee3b7679519de84eca9a6278aeb3da27e/analysis/1349758527/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f6-0844-4e96-8bee-42c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:10.000Z",
|
|
"modified": "2016-05-02T13:41:10.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ac8d334c5f519d5d146e7949036be964",
|
|
"pattern": "[file:hashes.SHA256 = '557e9735466a69d4d1ce8f95304bbd5cc1bd4753cb9cb40dae4783bfca1e3aac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f6-0840-4af4-b9b1-45ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:10.000Z",
|
|
"modified": "2016-05-02T13:41:10.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: ac8d334c5f519d5d146e7949036be964",
|
|
"pattern": "[file:hashes.SHA1 = '69ed8612b8881b32b1ee7a252ff7ecbb7ae0ece2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f6-9544-4f3b-b6eb-4faf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:10.000Z",
|
|
"modified": "2016-05-02T13:41:10.000Z",
|
|
"first_observed": "2016-05-02T13:41:10Z",
|
|
"last_observed": "2016-05-02T13:41:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f6-9544-4f3b-b6eb-4faf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f6-9544-4f3b-b6eb-4faf02de0b81",
|
|
"value": "https://www.virustotal.com/file/557e9735466a69d4d1ce8f95304bbd5cc1bd4753cb9cb40dae4783bfca1e3aac/analysis/1461326774/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f7-a0bc-48eb-9d87-4ffc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:11.000Z",
|
|
"modified": "2016-05-02T13:41:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: aa4cfb13a699eafb60e4ea0fb602f144",
|
|
"pattern": "[file:hashes.SHA256 = '9a750b06512d1ef5ddb59767d94db4fe9d9607962d56fd49255947c348c10e91']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f7-4ac4-497e-9866-45fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:11.000Z",
|
|
"modified": "2016-05-02T13:41:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: aa4cfb13a699eafb60e4ea0fb602f144",
|
|
"pattern": "[file:hashes.SHA1 = '46f28d17bf4677e9552aeb86a39c24c2603bb138']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f8-4ea8-460a-ae85-47d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:12.000Z",
|
|
"modified": "2016-05-02T13:41:12.000Z",
|
|
"first_observed": "2016-05-02T13:41:12Z",
|
|
"last_observed": "2016-05-02T13:41:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f8-4ea8-460a-ae85-47d302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f8-4ea8-460a-ae85-47d302de0b81",
|
|
"value": "https://www.virustotal.com/file/9a750b06512d1ef5ddb59767d94db4fe9d9607962d56fd49255947c348c10e91/analysis/1459761083/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f8-6bcc-44e2-8701-4a6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:12.000Z",
|
|
"modified": "2016-05-02T13:41:12.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: aa220955c78d5c4077249555d958dcb0",
|
|
"pattern": "[file:hashes.SHA256 = '9f5180e020275bbf8b9c76970c50f376bbd87f513495bcf3fb1cf7a6cf0c0d0c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f8-94e0-4d6a-85f7-419402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:12.000Z",
|
|
"modified": "2016-05-02T13:41:12.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: aa220955c78d5c4077249555d958dcb0",
|
|
"pattern": "[file:hashes.SHA1 = '259139a9f61737027949c90d7216c03aa6e0ae7f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758f9-b4b0-45ff-a2ca-4b1102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:13.000Z",
|
|
"modified": "2016-05-02T13:41:13.000Z",
|
|
"first_observed": "2016-05-02T13:41:13Z",
|
|
"last_observed": "2016-05-02T13:41:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758f9-b4b0-45ff-a2ca-4b1102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758f9-b4b0-45ff-a2ca-4b1102de0b81",
|
|
"value": "https://www.virustotal.com/file/9f5180e020275bbf8b9c76970c50f376bbd87f513495bcf3fb1cf7a6cf0c0d0c/analysis/1403686688/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758f9-7e8c-434f-9043-49c202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:13.000Z",
|
|
"modified": "2016-05-02T13:41:13.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a1ae4368352542f5f81ac072c3c00f11",
|
|
"pattern": "[file:hashes.SHA256 = '1880558b768b7c2dd31c9e0e53c833bd919294065b4fcb918d1cdc255519940b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fa-6f6c-41c2-a4ed-43a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:14.000Z",
|
|
"modified": "2016-05-02T13:41:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a1ae4368352542f5f81ac072c3c00f11",
|
|
"pattern": "[file:hashes.SHA1 = '3f55f99d787ec0adc8470045eb2da5a0490f7080']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758fa-b4fc-4a11-acc4-4aac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:14.000Z",
|
|
"modified": "2016-05-02T13:41:14.000Z",
|
|
"first_observed": "2016-05-02T13:41:14Z",
|
|
"last_observed": "2016-05-02T13:41:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758fa-b4fc-4a11-acc4-4aac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758fa-b4fc-4a11-acc4-4aac02de0b81",
|
|
"value": "https://www.virustotal.com/file/1880558b768b7c2dd31c9e0e53c833bd919294065b4fcb918d1cdc255519940b/analysis/1363544747/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fa-0700-4846-b8e8-41a702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:14.000Z",
|
|
"modified": "2016-05-02T13:41:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a161fc64a9c659264d0a897201a1b51d",
|
|
"pattern": "[file:hashes.SHA256 = '0aa1e8ad32b3d0e9aa072bd7ac7c4db095ca02040dad0a71ac33b7a56f9bb81b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fb-e55c-42cb-b8bd-47e602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:15.000Z",
|
|
"modified": "2016-05-02T13:41:15.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a161fc64a9c659264d0a897201a1b51d",
|
|
"pattern": "[file:hashes.SHA1 = '9078ff6af4e4c60e5bcf2e8d4ddc7d7c11aabbd8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758fb-8ef4-40b2-8f8e-4c5e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:15.000Z",
|
|
"modified": "2016-05-02T13:41:15.000Z",
|
|
"first_observed": "2016-05-02T13:41:15Z",
|
|
"last_observed": "2016-05-02T13:41:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758fb-8ef4-40b2-8f8e-4c5e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758fb-8ef4-40b2-8f8e-4c5e02de0b81",
|
|
"value": "https://www.virustotal.com/file/0aa1e8ad32b3d0e9aa072bd7ac7c4db095ca02040dad0a71ac33b7a56f9bb81b/analysis/1433946880/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fc-9f84-4936-89a7-4c0702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:16.000Z",
|
|
"modified": "2016-05-02T13:41:16.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a0ce7cb65688e16fe7cecbb5ee75ad16",
|
|
"pattern": "[file:hashes.SHA256 = 'd5435953b48ddc146e6e75e543019ac0bfd8093ed50c5feeeeeee5b19d986ac0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fc-8a08-4f48-a27e-420e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:16.000Z",
|
|
"modified": "2016-05-02T13:41:16.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: a0ce7cb65688e16fe7cecbb5ee75ad16",
|
|
"pattern": "[file:hashes.SHA1 = 'fe1058d9cca7630696581b55cb2a4b1243a183ae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758fc-4830-4e7b-b1e8-428002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:16.000Z",
|
|
"modified": "2016-05-02T13:41:16.000Z",
|
|
"first_observed": "2016-05-02T13:41:16Z",
|
|
"last_observed": "2016-05-02T13:41:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758fc-4830-4e7b-b1e8-428002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758fc-4830-4e7b-b1e8-428002de0b81",
|
|
"value": "https://www.virustotal.com/file/d5435953b48ddc146e6e75e543019ac0bfd8093ed50c5feeeeeee5b19d986ac0/analysis/1362158847/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fd-06cc-4eb2-ae5f-425602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:17.000Z",
|
|
"modified": "2016-05-02T13:41:17.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9f926c3ce839f5c2cce936cf7424da0c",
|
|
"pattern": "[file:hashes.SHA256 = '0f7b24298e1eb983adc9244ee2ff18e0a6dba5d269d42725d5dbac17910c4daf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fd-0b3c-4c5c-9bdd-478902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:17.000Z",
|
|
"modified": "2016-05-02T13:41:17.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9f926c3ce839f5c2cce936cf7424da0c",
|
|
"pattern": "[file:hashes.SHA1 = 'b6e627f52f2326da5e6c7bde5131c7b40fb84f4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758fe-2f18-4daa-a338-4c8d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:18.000Z",
|
|
"modified": "2016-05-02T13:41:18.000Z",
|
|
"first_observed": "2016-05-02T13:41:18Z",
|
|
"last_observed": "2016-05-02T13:41:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758fe-2f18-4daa-a338-4c8d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758fe-2f18-4daa-a338-4c8d02de0b81",
|
|
"value": "https://www.virustotal.com/file/0f7b24298e1eb983adc9244ee2ff18e0a6dba5d269d42725d5dbac17910c4daf/analysis/1425752792/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758fe-0cb4-4019-b87c-442a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:18.000Z",
|
|
"modified": "2016-05-02T13:41:18.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d80a85f363ac47612432d68959a7de5",
|
|
"pattern": "[file:hashes.SHA256 = '2db66ee3bd2e81e83e8ae15ba4d3043fbf4fef877ad0ae6963b7fad82d1e600e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ff-f4a0-4276-a0aa-4a9102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:19.000Z",
|
|
"modified": "2016-05-02T13:41:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d80a85f363ac47612432d68959a7de5",
|
|
"pattern": "[file:hashes.SHA1 = '6b0a46eb404c7f6e0cad22df1950c91a81b3e146']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--572758ff-b2e4-4a16-a196-4c5902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:19.000Z",
|
|
"modified": "2016-05-02T13:41:19.000Z",
|
|
"first_observed": "2016-05-02T13:41:19Z",
|
|
"last_observed": "2016-05-02T13:41:19Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--572758ff-b2e4-4a16-a196-4c5902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--572758ff-b2e4-4a16-a196-4c5902de0b81",
|
|
"value": "https://www.virustotal.com/file/2db66ee3bd2e81e83e8ae15ba4d3043fbf4fef877ad0ae6963b7fad82d1e600e/analysis/1370981915/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--572758ff-d98c-443e-93b8-422102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:19.000Z",
|
|
"modified": "2016-05-02T13:41:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d56d42b3d9a4f025926eeb54592c017",
|
|
"pattern": "[file:hashes.SHA256 = '14221a3a52de65fcf2e571cf025d91cb0420af4de9ddda9b97272d0fc4ce2f0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275900-3d4c-4f44-ac29-498502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:20.000Z",
|
|
"modified": "2016-05-02T13:41:20.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d56d42b3d9a4f025926eeb54592c017",
|
|
"pattern": "[file:hashes.SHA1 = '1ba82f8df27175d4927e61ec5976cef849492f9c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275900-5bcc-419b-a5c1-4f6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:20.000Z",
|
|
"modified": "2016-05-02T13:41:20.000Z",
|
|
"first_observed": "2016-05-02T13:41:20Z",
|
|
"last_observed": "2016-05-02T13:41:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275900-5bcc-419b-a5c1-4f6302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275900-5bcc-419b-a5c1-4f6302de0b81",
|
|
"value": "https://www.virustotal.com/file/14221a3a52de65fcf2e571cf025d91cb0420af4de9ddda9b97272d0fc4ce2f0a/analysis/1365627336/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275901-bc68-4132-949d-405b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:21.000Z",
|
|
"modified": "2016-05-02T13:41:21.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d1109ab2e0c382cc2839dffb0a41aa8",
|
|
"pattern": "[file:hashes.SHA256 = '2ea38f7c69f808a4b48f645cacbe1015825e1484fdddc2a17dfff7c5711c5c36']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275901-2d04-495c-a2d1-4ab002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:21.000Z",
|
|
"modified": "2016-05-02T13:41:21.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9d1109ab2e0c382cc2839dffb0a41aa8",
|
|
"pattern": "[file:hashes.SHA1 = 'a55edbcb3013d370c779fd69886cb173bc35d4cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275901-1f3c-4a9d-be28-4f1e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:21.000Z",
|
|
"modified": "2016-05-02T13:41:21.000Z",
|
|
"first_observed": "2016-05-02T13:41:21Z",
|
|
"last_observed": "2016-05-02T13:41:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275901-1f3c-4a9d-be28-4f1e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275901-1f3c-4a9d-be28-4f1e02de0b81",
|
|
"value": "https://www.virustotal.com/file/2ea38f7c69f808a4b48f645cacbe1015825e1484fdddc2a17dfff7c5711c5c36/analysis/1362138641/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275902-e360-43b1-b75d-44d902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:22.000Z",
|
|
"modified": "2016-05-02T13:41:22.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9c487d0d0a17ff44f5c8f5bd5b7687cf",
|
|
"pattern": "[file:hashes.SHA256 = '9c53a5fe62e3c2c7601664fd0d49bed7e1b3808e508db598f6ddd73594726cfb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275902-6278-49cf-8970-405502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:22.000Z",
|
|
"modified": "2016-05-02T13:41:22.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9c487d0d0a17ff44f5c8f5bd5b7687cf",
|
|
"pattern": "[file:hashes.SHA1 = '68715f2f73444826dcedf38d2492bf73392919d7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275903-4c34-44db-b75d-486602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:23.000Z",
|
|
"modified": "2016-05-02T13:41:23.000Z",
|
|
"first_observed": "2016-05-02T13:41:23Z",
|
|
"last_observed": "2016-05-02T13:41:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275903-4c34-44db-b75d-486602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275903-4c34-44db-b75d-486602de0b81",
|
|
"value": "https://www.virustotal.com/file/9c53a5fe62e3c2c7601664fd0d49bed7e1b3808e508db598f6ddd73594726cfb/analysis/1375131871/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275903-a698-4c88-b90e-491202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:23.000Z",
|
|
"modified": "2016-05-02T13:41:23.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9b9011532583aa3d4c626e932cad26ac",
|
|
"pattern": "[file:hashes.SHA256 = 'c2b9c1aa2ad096ea8cb3a491ee02d02dd3d7fea99571e6fb4f1bd14768e652c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275903-90f8-46f8-82b4-4e2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:23.000Z",
|
|
"modified": "2016-05-02T13:41:23.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9b9011532583aa3d4c626e932cad26ac",
|
|
"pattern": "[file:hashes.SHA1 = 'e73b1fe7340600f20d869836770450daca3ce48a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275904-180c-4afc-a7f3-4a6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:24.000Z",
|
|
"modified": "2016-05-02T13:41:24.000Z",
|
|
"first_observed": "2016-05-02T13:41:24Z",
|
|
"last_observed": "2016-05-02T13:41:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275904-180c-4afc-a7f3-4a6302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275904-180c-4afc-a7f3-4a6302de0b81",
|
|
"value": "https://www.virustotal.com/file/c2b9c1aa2ad096ea8cb3a491ee02d02dd3d7fea99571e6fb4f1bd14768e652c9/analysis/1367977320/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275904-d5f0-40cc-8d5b-426b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:24.000Z",
|
|
"modified": "2016-05-02T13:41:24.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9a78686ffb97a9942867785c7df54811",
|
|
"pattern": "[file:hashes.SHA256 = '781d3976c919533484a09463d9ede72585448c360ee2c26438746dd3bfdf3837']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275905-9fc8-4e96-a6d8-431002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:25.000Z",
|
|
"modified": "2016-05-02T13:41:25.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9a78686ffb97a9942867785c7df54811",
|
|
"pattern": "[file:hashes.SHA1 = 'db7b1dc803d58cc922fb222d832f153d1d42f0eb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275905-c144-40d0-8fac-4e1502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:25.000Z",
|
|
"modified": "2016-05-02T13:41:25.000Z",
|
|
"first_observed": "2016-05-02T13:41:25Z",
|
|
"last_observed": "2016-05-02T13:41:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275905-c144-40d0-8fac-4e1502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275905-c144-40d0-8fac-4e1502de0b81",
|
|
"value": "https://www.virustotal.com/file/781d3976c919533484a09463d9ede72585448c360ee2c26438746dd3bfdf3837/analysis/1360828553/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275906-c538-4a28-a515-4c7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:26.000Z",
|
|
"modified": "2016-05-02T13:41:26.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 99f4fdbbed01c6cccd014350d14b5817",
|
|
"pattern": "[file:hashes.SHA256 = 'c1ea128fb05d6f215ae13fa2062b922988108c021f26a2809e0f47e7906be627']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275906-9c6c-417b-98e6-489102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:26.000Z",
|
|
"modified": "2016-05-02T13:41:26.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 99f4fdbbed01c6cccd014350d14b5817",
|
|
"pattern": "[file:hashes.SHA1 = 'fb5cc640d5266b4991423659502f9bbbdc25b746']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275906-ef34-4dd5-acb5-40d002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:26.000Z",
|
|
"modified": "2016-05-02T13:41:26.000Z",
|
|
"first_observed": "2016-05-02T13:41:26Z",
|
|
"last_observed": "2016-05-02T13:41:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275906-ef34-4dd5-acb5-40d002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275906-ef34-4dd5-acb5-40d002de0b81",
|
|
"value": "https://www.virustotal.com/file/c1ea128fb05d6f215ae13fa2062b922988108c021f26a2809e0f47e7906be627/analysis/1450484159/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275907-676c-45dc-b9c9-4e7702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:27.000Z",
|
|
"modified": "2016-05-02T13:41:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9955f33e1f605bfe29b91b9efe242fb0",
|
|
"pattern": "[file:hashes.SHA256 = '1a99aa618d6a3b739e128a7fd691d8f16a43d9015d9f64b53c1aa16859901291']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275907-26c0-4cf3-9cb0-4c8202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:27.000Z",
|
|
"modified": "2016-05-02T13:41:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9955f33e1f605bfe29b91b9efe242fb0",
|
|
"pattern": "[file:hashes.SHA1 = '84de585734ebc27038f0f926ff7b828197c85b0d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275908-81b0-4126-8504-4b5e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:28.000Z",
|
|
"modified": "2016-05-02T13:41:28.000Z",
|
|
"first_observed": "2016-05-02T13:41:28Z",
|
|
"last_observed": "2016-05-02T13:41:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275908-81b0-4126-8504-4b5e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275908-81b0-4126-8504-4b5e02de0b81",
|
|
"value": "https://www.virustotal.com/file/1a99aa618d6a3b739e128a7fd691d8f16a43d9015d9f64b53c1aa16859901291/analysis/1401052837/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275908-0e70-43e5-ac25-4e3802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:28.000Z",
|
|
"modified": "2016-05-02T13:41:28.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9942a1f59cd48b27931977c400328a68",
|
|
"pattern": "[file:hashes.SHA256 = '2b506a461f7b3af95cff72642a2cc623570c3c99d413044c42aec9d455cf943c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275908-3774-4409-b446-4c6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:28.000Z",
|
|
"modified": "2016-05-02T13:41:28.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 9942a1f59cd48b27931977c400328a68",
|
|
"pattern": "[file:hashes.SHA1 = '28976c401b6e27dfd1c3fa34e8fd36f614025107']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275909-daa8-4e94-8361-40ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:29.000Z",
|
|
"modified": "2016-05-02T13:41:29.000Z",
|
|
"first_observed": "2016-05-02T13:41:29Z",
|
|
"last_observed": "2016-05-02T13:41:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275909-daa8-4e94-8361-40ee02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275909-daa8-4e94-8361-40ee02de0b81",
|
|
"value": "https://www.virustotal.com/file/2b506a461f7b3af95cff72642a2cc623570c3c99d413044c42aec9d455cf943c/analysis/1377031952/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275909-8fa4-45cd-9d71-42f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:29.000Z",
|
|
"modified": "2016-05-02T13:41:29.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 95f0b3a442f0f14746d367e4273c787b",
|
|
"pattern": "[file:hashes.SHA256 = 'fe8152039bb75a2dda018cb8afd6f2ff0137865ce2cf04adc40ced85d2dd995a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590a-7ac4-407a-96bc-4e6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:30.000Z",
|
|
"modified": "2016-05-02T13:41:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 95f0b3a442f0f14746d367e4273c787b",
|
|
"pattern": "[file:hashes.SHA1 = '22d04689966766e7e811c939375013c490460688']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727590a-cdac-4c7e-8939-412802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:30.000Z",
|
|
"modified": "2016-05-02T13:41:30.000Z",
|
|
"first_observed": "2016-05-02T13:41:30Z",
|
|
"last_observed": "2016-05-02T13:41:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727590a-cdac-4c7e-8939-412802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727590a-cdac-4c7e-8939-412802de0b81",
|
|
"value": "https://www.virustotal.com/file/fe8152039bb75a2dda018cb8afd6f2ff0137865ce2cf04adc40ced85d2dd995a/analysis/1434877947/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590a-c294-4a32-91cd-476302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:30.000Z",
|
|
"modified": "2016-05-02T13:41:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 94d9590903fd123329de054f6988a17e",
|
|
"pattern": "[file:hashes.SHA256 = 'ca50bb6c13d2f44b2e41c868d69696751abe027a58fec4a3ced32652f074c867']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590b-7f50-4885-a3e5-432102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:31.000Z",
|
|
"modified": "2016-05-02T13:41:31.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 94d9590903fd123329de054f6988a17e",
|
|
"pattern": "[file:hashes.SHA1 = '1468ad7f75fd693c1e8081bc0191bf88a1e1b1c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727590b-d0a0-4c38-9e93-4b1202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:31.000Z",
|
|
"modified": "2016-05-02T13:41:31.000Z",
|
|
"first_observed": "2016-05-02T13:41:31Z",
|
|
"last_observed": "2016-05-02T13:41:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727590b-d0a0-4c38-9e93-4b1202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727590b-d0a0-4c38-9e93-4b1202de0b81",
|
|
"value": "https://www.virustotal.com/file/ca50bb6c13d2f44b2e41c868d69696751abe027a58fec4a3ced32652f074c867/analysis/1398130122/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590c-94b0-4fcd-a3d0-478e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:32.000Z",
|
|
"modified": "2016-05-02T13:41:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 926c851ae6bea03f97cb3c2f17c6204d",
|
|
"pattern": "[file:hashes.SHA256 = '6ae9c9ddefde7d0298e13c2747655b691b45ecc157846f3ac0643f01e3a0f353']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590c-01d0-402b-b195-486a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:32.000Z",
|
|
"modified": "2016-05-02T13:41:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 926c851ae6bea03f97cb3c2f17c6204d",
|
|
"pattern": "[file:hashes.SHA1 = '42c0e0699b25ef0cd203d09bacb3c36556354c24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727590d-4270-4cb9-9946-497b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:33.000Z",
|
|
"modified": "2016-05-02T13:41:33.000Z",
|
|
"first_observed": "2016-05-02T13:41:33Z",
|
|
"last_observed": "2016-05-02T13:41:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727590d-4270-4cb9-9946-497b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727590d-4270-4cb9-9946-497b02de0b81",
|
|
"value": "https://www.virustotal.com/file/6ae9c9ddefde7d0298e13c2747655b691b45ecc157846f3ac0643f01e3a0f353/analysis/1361251838/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590d-4dc0-4058-9bc2-4b8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:33.000Z",
|
|
"modified": "2016-05-02T13:41:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 91b7beb61cb7f7f7b42429d389477063",
|
|
"pattern": "[file:hashes.SHA256 = '6c03b3323915e788db04166ea6563c6d4b08e0ffcb92bf902a351f3ab1bb2c02']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590d-1298-4a08-b51d-425e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:33.000Z",
|
|
"modified": "2016-05-02T13:41:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 91b7beb61cb7f7f7b42429d389477063",
|
|
"pattern": "[file:hashes.SHA1 = '8e3c73c2de4ceffcb7110a70bd0e1ac8556adca3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727590e-a710-46b7-895f-448002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:34.000Z",
|
|
"modified": "2016-05-02T13:41:34.000Z",
|
|
"first_observed": "2016-05-02T13:41:34Z",
|
|
"last_observed": "2016-05-02T13:41:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727590e-a710-46b7-895f-448002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727590e-a710-46b7-895f-448002de0b81",
|
|
"value": "https://www.virustotal.com/file/6c03b3323915e788db04166ea6563c6d4b08e0ffcb92bf902a351f3ab1bb2c02/analysis/1377745877/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590e-7ab0-413f-be00-464f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:34.000Z",
|
|
"modified": "2016-05-02T13:41:34.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8d2ab6bf1ded4e1f588385865bc9574a",
|
|
"pattern": "[file:hashes.SHA256 = 'c568b38b13eb6289487c36b8674f84b0a19f2faa95830f8d5b179ada713ad9b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590f-6364-4a89-b929-40fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:35.000Z",
|
|
"modified": "2016-05-02T13:41:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8d2ab6bf1ded4e1f588385865bc9574a",
|
|
"pattern": "[file:hashes.SHA1 = 'eae18d723301da5f7ea641f121634a3c02393b3e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727590f-1d80-4a0e-88ef-44a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:35.000Z",
|
|
"modified": "2016-05-02T13:41:35.000Z",
|
|
"first_observed": "2016-05-02T13:41:35Z",
|
|
"last_observed": "2016-05-02T13:41:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727590f-1d80-4a0e-88ef-44a902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727590f-1d80-4a0e-88ef-44a902de0b81",
|
|
"value": "https://www.virustotal.com/file/c568b38b13eb6289487c36b8674f84b0a19f2faa95830f8d5b179ada713ad9b0/analysis/1376377519/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727590f-0390-4958-98c1-46c202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:35.000Z",
|
|
"modified": "2016-05-02T13:41:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8c7ec022ef9b6e8e30b6761da0975aea",
|
|
"pattern": "[file:hashes.SHA256 = '1e6e9a68c69db1d1e164ae9798c06436052a063a9b40a591b1fbacb9a99a3e05']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275910-48d8-4e32-8d95-4deb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:36.000Z",
|
|
"modified": "2016-05-02T13:41:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8c7ec022ef9b6e8e30b6761da0975aea",
|
|
"pattern": "[file:hashes.SHA1 = '4ffa56b27768139c394f6714d6582f7a687f7751']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275910-e054-49d1-bfe1-4ca102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:36.000Z",
|
|
"modified": "2016-05-02T13:41:36.000Z",
|
|
"first_observed": "2016-05-02T13:41:36Z",
|
|
"last_observed": "2016-05-02T13:41:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275910-e054-49d1-bfe1-4ca102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275910-e054-49d1-bfe1-4ca102de0b81",
|
|
"value": "https://www.virustotal.com/file/1e6e9a68c69db1d1e164ae9798c06436052a063a9b40a591b1fbacb9a99a3e05/analysis/1450249168/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275911-30e0-4a32-9845-4a2002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:37.000Z",
|
|
"modified": "2016-05-02T13:41:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8ae6139ba59a6d94d82a97464f185c16",
|
|
"pattern": "[file:hashes.SHA256 = 'aa63a6c1caf3b860e142dec0f94ef30cd0fd5e0fe55594b8e8bfc20c1a3e447f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275911-abac-4364-944b-44da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:37.000Z",
|
|
"modified": "2016-05-02T13:41:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8ae6139ba59a6d94d82a97464f185c16",
|
|
"pattern": "[file:hashes.SHA1 = '9265ef13f0729b9a359cd0332be1f69536953757']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275911-fac0-43ad-b9da-445502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:37.000Z",
|
|
"modified": "2016-05-02T13:41:37.000Z",
|
|
"first_observed": "2016-05-02T13:41:37Z",
|
|
"last_observed": "2016-05-02T13:41:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275911-fac0-43ad-b9da-445502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275911-fac0-43ad-b9da-445502de0b81",
|
|
"value": "https://www.virustotal.com/file/aa63a6c1caf3b860e142dec0f94ef30cd0fd5e0fe55594b8e8bfc20c1a3e447f/analysis/1377653749/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275912-db7c-428b-99f8-4d6002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:38.000Z",
|
|
"modified": "2016-05-02T13:41:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8a1f29d4fea917b8548cb9a936126daa",
|
|
"pattern": "[file:hashes.SHA256 = '7788d313ec12ae11595cb653bb47517fbbc1e076ac3c2986cd65251cedf32bf9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275912-edd8-4693-aa30-46d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:38.000Z",
|
|
"modified": "2016-05-02T13:41:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8a1f29d4fea917b8548cb9a936126daa",
|
|
"pattern": "[file:hashes.SHA1 = '232160c1f2291ea5199ee1366124b90f86f9415c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275913-30d0-46ea-81b1-491402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:39.000Z",
|
|
"modified": "2016-05-02T13:41:39.000Z",
|
|
"first_observed": "2016-05-02T13:41:39Z",
|
|
"last_observed": "2016-05-02T13:41:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275913-30d0-46ea-81b1-491402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275913-30d0-46ea-81b1-491402de0b81",
|
|
"value": "https://www.virustotal.com/file/7788d313ec12ae11595cb653bb47517fbbc1e076ac3c2986cd65251cedf32bf9/analysis/1360584614/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275913-9d5c-48ca-8c0a-4e4802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:39.000Z",
|
|
"modified": "2016-05-02T13:41:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 85f37501477284f032c3d3981c5a8a75",
|
|
"pattern": "[file:hashes.SHA256 = 'f3382b5e38a535cc7c6bb50e8f6671a612ad5a25cf4bea6f9625070e47274b97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275914-33a4-4513-a872-4ffd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:40.000Z",
|
|
"modified": "2016-05-02T13:41:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 85f37501477284f032c3d3981c5a8a75",
|
|
"pattern": "[file:hashes.SHA1 = 'b547b3b8e586a638d0323cb7c3ff05bd7db8bbdf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275914-08f4-41a9-ae36-405402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:40.000Z",
|
|
"modified": "2016-05-02T13:41:40.000Z",
|
|
"first_observed": "2016-05-02T13:41:40Z",
|
|
"last_observed": "2016-05-02T13:41:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275914-08f4-41a9-ae36-405402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275914-08f4-41a9-ae36-405402de0b81",
|
|
"value": "https://www.virustotal.com/file/f3382b5e38a535cc7c6bb50e8f6671a612ad5a25cf4bea6f9625070e47274b97/analysis/1361303351/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275914-3338-4eae-978d-464002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:40.000Z",
|
|
"modified": "2016-05-02T13:41:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8448f958a6acdb606f6f1242a963f845",
|
|
"pattern": "[file:hashes.SHA256 = '8e7a8fd9ff31a1148881044f86696522b999ae3bdc71eb11301b2bff199b371e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275915-c18c-4385-aa5d-4e8102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:41.000Z",
|
|
"modified": "2016-05-02T13:41:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 8448f958a6acdb606f6f1242a963f845",
|
|
"pattern": "[file:hashes.SHA1 = '17df2a41184a08adee92debd8ffc130f3ccf427b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275915-873c-4cba-a3dd-44c202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:41.000Z",
|
|
"modified": "2016-05-02T13:41:41.000Z",
|
|
"first_observed": "2016-05-02T13:41:41Z",
|
|
"last_observed": "2016-05-02T13:41:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275915-873c-4cba-a3dd-44c202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275915-873c-4cba-a3dd-44c202de0b81",
|
|
"value": "https://www.virustotal.com/file/8e7a8fd9ff31a1148881044f86696522b999ae3bdc71eb11301b2bff199b371e/analysis/1358518223/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275916-8520-4578-9cf5-4dc002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:42.000Z",
|
|
"modified": "2016-05-02T13:41:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7e9552cbe1afdb03cedff301f2080f9c",
|
|
"pattern": "[file:hashes.SHA256 = '9d91d8179270b49d4d5c7ca248eb8417d88112c2a5fb58c9de3314275ff00581']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275916-86c4-4638-858c-464b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:42.000Z",
|
|
"modified": "2016-05-02T13:41:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7e9552cbe1afdb03cedff301f2080f9c",
|
|
"pattern": "[file:hashes.SHA1 = '0ed1cb445bab954f7a84c6ffc9f86783f72cd5ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275916-06a4-4c08-ac3a-4c6402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:42.000Z",
|
|
"modified": "2016-05-02T13:41:42.000Z",
|
|
"first_observed": "2016-05-02T13:41:42Z",
|
|
"last_observed": "2016-05-02T13:41:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275916-06a4-4c08-ac3a-4c6402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275916-06a4-4c08-ac3a-4c6402de0b81",
|
|
"value": "https://www.virustotal.com/file/9d91d8179270b49d4d5c7ca248eb8417d88112c2a5fb58c9de3314275ff00581/analysis/1424807786/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275917-263c-48d6-a38a-4cd402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:43.000Z",
|
|
"modified": "2016-05-02T13:41:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7c8e950c3adcbbcca2c8b54614566ec7",
|
|
"pattern": "[file:hashes.SHA256 = 'c384361741dfb1c4734f7e4c14cff3da362fdde8a4bdf7af6bfaa78f767f9570']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275917-2a00-450a-8b40-45b002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:43.000Z",
|
|
"modified": "2016-05-02T13:41:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7c8e950c3adcbbcca2c8b54614566ec7",
|
|
"pattern": "[file:hashes.SHA1 = '8ca27f052d3f2fb4b02ea86e5f5b0f3dd1c3febf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275918-24d0-40c4-a505-4fa902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:44.000Z",
|
|
"modified": "2016-05-02T13:41:44.000Z",
|
|
"first_observed": "2016-05-02T13:41:44Z",
|
|
"last_observed": "2016-05-02T13:41:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275918-24d0-40c4-a505-4fa902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275918-24d0-40c4-a505-4fa902de0b81",
|
|
"value": "https://www.virustotal.com/file/c384361741dfb1c4734f7e4c14cff3da362fdde8a4bdf7af6bfaa78f767f9570/analysis/1458288737/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275918-e498-4416-8d79-478b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:44.000Z",
|
|
"modified": "2016-05-02T13:41:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7a64fef96e69f58bd52abdff97cc95a5",
|
|
"pattern": "[file:hashes.SHA256 = '654f5dd5da39a127d6f4972d98950ba199fce2d84a3c68f137ee98d8e2778b26']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275919-d710-4ebd-8f7b-493a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:44.000Z",
|
|
"modified": "2016-05-02T13:41:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 7a64fef96e69f58bd52abdff97cc95a5",
|
|
"pattern": "[file:hashes.SHA1 = '61279f2abbb80c8fd2fdd88adbe11b9df0941f6b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275919-be18-47b1-8d7a-47bf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:45.000Z",
|
|
"modified": "2016-05-02T13:41:45.000Z",
|
|
"first_observed": "2016-05-02T13:41:45Z",
|
|
"last_observed": "2016-05-02T13:41:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275919-be18-47b1-8d7a-47bf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275919-be18-47b1-8d7a-47bf02de0b81",
|
|
"value": "https://www.virustotal.com/file/654f5dd5da39a127d6f4972d98950ba199fce2d84a3c68f137ee98d8e2778b26/analysis/1360921091/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275919-f780-48e2-a6c4-49f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:45.000Z",
|
|
"modified": "2016-05-02T13:41:45.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 79a07963b57d0bbae1625cf582d2a55a",
|
|
"pattern": "[file:hashes.SHA256 = '2b9477399308bcc0c8f91aa6fa2738d5cf96a3f95e294eba8b5b97cc641ab851']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591a-1bf8-42c0-b820-41eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:46.000Z",
|
|
"modified": "2016-05-02T13:41:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 79a07963b57d0bbae1625cf582d2a55a",
|
|
"pattern": "[file:hashes.SHA1 = '736686321847af2a442252e6af591f7308418853']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727591a-447c-4555-8ad8-415902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:46.000Z",
|
|
"modified": "2016-05-02T13:41:46.000Z",
|
|
"first_observed": "2016-05-02T13:41:46Z",
|
|
"last_observed": "2016-05-02T13:41:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727591a-447c-4555-8ad8-415902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727591a-447c-4555-8ad8-415902de0b81",
|
|
"value": "https://www.virustotal.com/file/2b9477399308bcc0c8f91aa6fa2738d5cf96a3f95e294eba8b5b97cc641ab851/analysis/1378358098/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591b-f89c-4faa-ac1a-484f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:47.000Z",
|
|
"modified": "2016-05-02T13:41:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 763259b197082bd81233aed55749275f",
|
|
"pattern": "[file:hashes.SHA256 = '828dc94d473a02fe0c127bc030ee8cdee8b5cea1514e1cacd1fcf924be637dd1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591b-03c4-43c0-af14-411002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:47.000Z",
|
|
"modified": "2016-05-02T13:41:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 763259b197082bd81233aed55749275f",
|
|
"pattern": "[file:hashes.SHA1 = '398966499df3fc515d3cbd95110a76f1ac55af48']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727591b-2928-489c-a9d1-493e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:47.000Z",
|
|
"modified": "2016-05-02T13:41:47.000Z",
|
|
"first_observed": "2016-05-02T13:41:47Z",
|
|
"last_observed": "2016-05-02T13:41:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727591b-2928-489c-a9d1-493e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727591b-2928-489c-a9d1-493e02de0b81",
|
|
"value": "https://www.virustotal.com/file/828dc94d473a02fe0c127bc030ee8cdee8b5cea1514e1cacd1fcf924be637dd1/analysis/1425041290/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591c-8f68-4f15-8013-4ccd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:48.000Z",
|
|
"modified": "2016-05-02T13:41:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 72207024854e6c8e83996f3baa659e6b",
|
|
"pattern": "[file:hashes.SHA256 = '37e2b06c51d6a17d8efb426e52f801ce3a0a7c7615d78e36a9819b9c67285527']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591c-3590-4dd7-8742-4b4902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:48.000Z",
|
|
"modified": "2016-05-02T13:41:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 72207024854e6c8e83996f3baa659e6b",
|
|
"pattern": "[file:hashes.SHA1 = 'c480b74997e349a57b571d3a5bcc3347f48d2af2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727591d-4c00-47c1-b36e-4ea602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:49.000Z",
|
|
"modified": "2016-05-02T13:41:49.000Z",
|
|
"first_observed": "2016-05-02T13:41:49Z",
|
|
"last_observed": "2016-05-02T13:41:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727591d-4c00-47c1-b36e-4ea602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727591d-4c00-47c1-b36e-4ea602de0b81",
|
|
"value": "https://www.virustotal.com/file/37e2b06c51d6a17d8efb426e52f801ce3a0a7c7615d78e36a9819b9c67285527/analysis/1425899531/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591d-7b40-4ec9-a05a-4f1902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:49.000Z",
|
|
"modified": "2016-05-02T13:41:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6f4d9b956180e74b17fe3c29063f5691",
|
|
"pattern": "[file:hashes.SHA256 = '00246f1386706a0a1aa8e06db686d72f64fa5c8a9b87b183b66dd3a8b12e7331']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591d-0a9c-4ff7-8977-4b8402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:49.000Z",
|
|
"modified": "2016-05-02T13:41:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6f4d9b956180e74b17fe3c29063f5691",
|
|
"pattern": "[file:hashes.SHA1 = '87fc148eada76cdbdd8f6edfce90db95af3f52d2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727591e-7590-46d6-b83d-46e702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:50.000Z",
|
|
"modified": "2016-05-02T13:41:50.000Z",
|
|
"first_observed": "2016-05-02T13:41:50Z",
|
|
"last_observed": "2016-05-02T13:41:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727591e-7590-46d6-b83d-46e702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727591e-7590-46d6-b83d-46e702de0b81",
|
|
"value": "https://www.virustotal.com/file/00246f1386706a0a1aa8e06db686d72f64fa5c8a9b87b183b66dd3a8b12e7331/analysis/1362113665/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591e-efd0-42a1-837f-47cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:50.000Z",
|
|
"modified": "2016-05-02T13:41:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6e4e52cf69e37d2d540a431f23d7015a",
|
|
"pattern": "[file:hashes.SHA256 = '9295dabb4041472692def68561745778426d28dc9d38d21934f09b440c173e96']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727591f-6434-4394-88ec-45a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:51.000Z",
|
|
"modified": "2016-05-02T13:41:51.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6e4e52cf69e37d2d540a431f23d7015a",
|
|
"pattern": "[file:hashes.SHA1 = '941b33ea1ae152c658119adda523b9f872fe75cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727591f-a708-4b8e-8b55-41c102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:51.000Z",
|
|
"modified": "2016-05-02T13:41:51.000Z",
|
|
"first_observed": "2016-05-02T13:41:51Z",
|
|
"last_observed": "2016-05-02T13:41:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727591f-a708-4b8e-8b55-41c102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727591f-a708-4b8e-8b55-41c102de0b81",
|
|
"value": "https://www.virustotal.com/file/9295dabb4041472692def68561745778426d28dc9d38d21934f09b440c173e96/analysis/1449718244/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275920-dd90-4ec7-8c9d-4e6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:52.000Z",
|
|
"modified": "2016-05-02T13:41:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6bc1aea97e7b420b0993eff794ed2aeb",
|
|
"pattern": "[file:hashes.SHA256 = 'a9a08339faa8ae6ae048e6808233bf14cd393d5d32f236a608e76ef30d8f1f40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275920-cbfc-4e0d-baba-460d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:52.000Z",
|
|
"modified": "2016-05-02T13:41:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6bc1aea97e7b420b0993eff794ed2aeb",
|
|
"pattern": "[file:hashes.SHA1 = 'fc6af27ccd1a3d06ee2d4fcfc4648672fbe7ce76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275920-e178-41d0-bc89-4ae402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:52.000Z",
|
|
"modified": "2016-05-02T13:41:52.000Z",
|
|
"first_observed": "2016-05-02T13:41:52Z",
|
|
"last_observed": "2016-05-02T13:41:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275920-e178-41d0-bc89-4ae402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275920-e178-41d0-bc89-4ae402de0b81",
|
|
"value": "https://www.virustotal.com/file/a9a08339faa8ae6ae048e6808233bf14cd393d5d32f236a608e76ef30d8f1f40/analysis/1372064805/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275921-9ea8-43d4-8414-445202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:53.000Z",
|
|
"modified": "2016-05-02T13:41:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6a963c5f650d6e3d56062eb0789e4a8b",
|
|
"pattern": "[file:hashes.SHA256 = '979a7df4fe5bd47467a3a2ee312c39b6f9704e44ce0e7ca54c1d69aac175bd4b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275921-90fc-487b-9235-49a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:53.000Z",
|
|
"modified": "2016-05-02T13:41:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6a963c5f650d6e3d56062eb0789e4a8b",
|
|
"pattern": "[file:hashes.SHA1 = '4c408ab80dec63870b5bc2873fd8497cadc1de4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275922-15e4-4ee3-ab55-489802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:54.000Z",
|
|
"modified": "2016-05-02T13:41:54.000Z",
|
|
"first_observed": "2016-05-02T13:41:54Z",
|
|
"last_observed": "2016-05-02T13:41:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275922-15e4-4ee3-ab55-489802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275922-15e4-4ee3-ab55-489802de0b81",
|
|
"value": "https://www.virustotal.com/file/979a7df4fe5bd47467a3a2ee312c39b6f9704e44ce0e7ca54c1d69aac175bd4b/analysis/1407909674/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275922-9064-4274-8a04-40da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:54.000Z",
|
|
"modified": "2016-05-02T13:41:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 69b075a20f94532f8f82100a418de1f2",
|
|
"pattern": "[file:hashes.SHA256 = '36ffb8d4a9fe9b6003c5b3859f4b7b5076cdfe560d6c15cdced27db120e689ef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275922-7c0c-4915-9803-415402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:54.000Z",
|
|
"modified": "2016-05-02T13:41:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 69b075a20f94532f8f82100a418de1f2",
|
|
"pattern": "[file:hashes.SHA1 = '0df50fd0c49b1182dcea7071f39be7602a247753']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275923-3278-4a44-9ece-4b1802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:55.000Z",
|
|
"modified": "2016-05-02T13:41:55.000Z",
|
|
"first_observed": "2016-05-02T13:41:55Z",
|
|
"last_observed": "2016-05-02T13:41:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275923-3278-4a44-9ece-4b1802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275923-3278-4a44-9ece-4b1802de0b81",
|
|
"value": "https://www.virustotal.com/file/36ffb8d4a9fe9b6003c5b3859f4b7b5076cdfe560d6c15cdced27db120e689ef/analysis/1453337602/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275923-efd4-49eb-a56c-4de302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:55.000Z",
|
|
"modified": "2016-05-02T13:41:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6852787a390630ba38920c2998e60151",
|
|
"pattern": "[file:hashes.SHA256 = 'f20a95b12ecae1baa7d04cc77b60cc97237f5981bdac2dabdbe1d15967918b38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275924-dae0-42a2-81b8-4eaf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:56.000Z",
|
|
"modified": "2016-05-02T13:41:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6852787a390630ba38920c2998e60151",
|
|
"pattern": "[file:hashes.SHA1 = '66707453f100cceefc3912513eea94e5bd493e9a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275924-4218-4178-972b-477502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:56.000Z",
|
|
"modified": "2016-05-02T13:41:56.000Z",
|
|
"first_observed": "2016-05-02T13:41:56Z",
|
|
"last_observed": "2016-05-02T13:41:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275924-4218-4178-972b-477502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275924-4218-4178-972b-477502de0b81",
|
|
"value": "https://www.virustotal.com/file/f20a95b12ecae1baa7d04cc77b60cc97237f5981bdac2dabdbe1d15967918b38/analysis/1445821084/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275924-8a98-4e89-8951-4ae402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:56.000Z",
|
|
"modified": "2016-05-02T13:41:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6588d0b81d0491d7c1cd7ef88c2c1494",
|
|
"pattern": "[file:hashes.SHA256 = 'ba78cf97816627e13fcc1223e84ce456b9946ecf1bce718e918a200546c3801a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275925-6824-4951-be7f-4e5002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:57.000Z",
|
|
"modified": "2016-05-02T13:41:57.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 6588d0b81d0491d7c1cd7ef88c2c1494",
|
|
"pattern": "[file:hashes.SHA1 = 'd4fe4e6d85963c46f34a92b3dee46c0e26aacd2c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275925-3a54-42c5-9cc2-4e0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:57.000Z",
|
|
"modified": "2016-05-02T13:41:57.000Z",
|
|
"first_observed": "2016-05-02T13:41:57Z",
|
|
"last_observed": "2016-05-02T13:41:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275925-3a54-42c5-9cc2-4e0d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275925-3a54-42c5-9cc2-4e0d02de0b81",
|
|
"value": "https://www.virustotal.com/file/ba78cf97816627e13fcc1223e84ce456b9946ecf1bce718e918a200546c3801a/analysis/1361196550/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275926-d338-4aaa-a1d5-4ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:58.000Z",
|
|
"modified": "2016-05-02T13:41:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5e5709043f1113d87b309e91b3cfae7e",
|
|
"pattern": "[file:hashes.SHA256 = '74101bb12ad717b1f4c079220ccb32a579ab756c295d821d278743628c8778a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275926-572c-4fcc-9eb9-446b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:58.000Z",
|
|
"modified": "2016-05-02T13:41:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5e5709043f1113d87b309e91b3cfae7e",
|
|
"pattern": "[file:hashes.SHA1 = '7f227627a0b0d0c8c607fa867f1be34cd3b86671']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275927-dec0-4c36-9aa3-461902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:59.000Z",
|
|
"modified": "2016-05-02T13:41:59.000Z",
|
|
"first_observed": "2016-05-02T13:41:59Z",
|
|
"last_observed": "2016-05-02T13:41:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275927-dec0-4c36-9aa3-461902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275927-dec0-4c36-9aa3-461902de0b81",
|
|
"value": "https://www.virustotal.com/file/74101bb12ad717b1f4c079220ccb32a579ab756c295d821d278743628c8778a3/analysis/1425530138/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275927-d3cc-4966-9cd4-492c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:59.000Z",
|
|
"modified": "2016-05-02T13:41:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5dc7347bafd0874be2430b71953738e6",
|
|
"pattern": "[file:hashes.SHA256 = 'bc69247a6eeda94ab118da3a9071309cd12484706e15c9da7fd5e618be6a0f57']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275927-9ce4-4891-8a68-418902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:41:59.000Z",
|
|
"modified": "2016-05-02T13:41:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5dc7347bafd0874be2430b71953738e6",
|
|
"pattern": "[file:hashes.SHA1 = '82ce4a627034d36b59ad0dbc26b9eb6c83c6fe44']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:41:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275928-3384-419c-8313-433502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:00.000Z",
|
|
"modified": "2016-05-02T13:42:00.000Z",
|
|
"first_observed": "2016-05-02T13:42:00Z",
|
|
"last_observed": "2016-05-02T13:42:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275928-3384-419c-8313-433502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275928-3384-419c-8313-433502de0b81",
|
|
"value": "https://www.virustotal.com/file/bc69247a6eeda94ab118da3a9071309cd12484706e15c9da7fd5e618be6a0f57/analysis/1415487509/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275928-7c44-4c09-91d6-405302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:00.000Z",
|
|
"modified": "2016-05-02T13:42:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5cccc95e3795c347d1609c62f3127da5",
|
|
"pattern": "[file:hashes.SHA256 = 'b7170b06ff9aefb8c82ac0d336cc99f75cb9b08ef71c6aa62b39497bb3c87a05']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275929-0524-4c84-9a20-48cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:01.000Z",
|
|
"modified": "2016-05-02T13:42:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5cccc95e3795c347d1609c62f3127da5",
|
|
"pattern": "[file:hashes.SHA1 = 'ce597a65277b427f1600931995e34ed0cefa3bbb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275929-a950-4ffe-87a4-468e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:01.000Z",
|
|
"modified": "2016-05-02T13:42:01.000Z",
|
|
"first_observed": "2016-05-02T13:42:01Z",
|
|
"last_observed": "2016-05-02T13:42:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275929-a950-4ffe-87a4-468e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275929-a950-4ffe-87a4-468e02de0b81",
|
|
"value": "https://www.virustotal.com/file/b7170b06ff9aefb8c82ac0d336cc99f75cb9b08ef71c6aa62b39497bb3c87a05/analysis/1433551806/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275929-dc8c-4f88-93aa-468002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:01.000Z",
|
|
"modified": "2016-05-02T13:42:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5acba38d707f3d5015e64550c7689c05",
|
|
"pattern": "[file:hashes.SHA256 = '540a266998109389da98f30e07a7350bdd10cf65b54d177a4aab20c559d80972']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592a-801c-4ba3-9632-4ca402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:02.000Z",
|
|
"modified": "2016-05-02T13:42:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5acba38d707f3d5015e64550c7689c05",
|
|
"pattern": "[file:hashes.SHA1 = 'bd60d2ce407e2fd08308521b0ad423f4d9ec15ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727592a-4e1c-48f1-8139-4eef02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:02.000Z",
|
|
"modified": "2016-05-02T13:42:02.000Z",
|
|
"first_observed": "2016-05-02T13:42:02Z",
|
|
"last_observed": "2016-05-02T13:42:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727592a-4e1c-48f1-8139-4eef02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727592a-4e1c-48f1-8139-4eef02de0b81",
|
|
"value": "https://www.virustotal.com/file/540a266998109389da98f30e07a7350bdd10cf65b54d177a4aab20c559d80972/analysis/1380248163/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592b-18cc-49e8-ac69-468a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:03.000Z",
|
|
"modified": "2016-05-02T13:42:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5ab14c2503fca14ca416d3bc0ae62a8d",
|
|
"pattern": "[file:hashes.SHA256 = '5655adef4a05f29fc003ea573f10f219b3cad4d4a811c8355349118b89bb35ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592b-ef14-40ff-9e0b-48d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:03.000Z",
|
|
"modified": "2016-05-02T13:42:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5ab14c2503fca14ca416d3bc0ae62a8d",
|
|
"pattern": "[file:hashes.SHA1 = '9adbdee08e9088c43b365c524642a399e35cd9b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727592b-0628-4b0f-ac47-409902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:03.000Z",
|
|
"modified": "2016-05-02T13:42:03.000Z",
|
|
"first_observed": "2016-05-02T13:42:03Z",
|
|
"last_observed": "2016-05-02T13:42:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727592b-0628-4b0f-ac47-409902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727592b-0628-4b0f-ac47-409902de0b81",
|
|
"value": "https://www.virustotal.com/file/5655adef4a05f29fc003ea573f10f219b3cad4d4a811c8355349118b89bb35ee/analysis/1429838509/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592c-5c30-49f9-bbc3-4c2502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:04.000Z",
|
|
"modified": "2016-05-02T13:42:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 578677cc3e31dab487280dc50c90ac4c",
|
|
"pattern": "[file:hashes.SHA256 = '3fdf9126e55826c7abbf5d191f93096b966a3e59cebff6f1f804c4153b62cc47']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592c-64c8-431d-9c53-4d8902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:04.000Z",
|
|
"modified": "2016-05-02T13:42:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 578677cc3e31dab487280dc50c90ac4c",
|
|
"pattern": "[file:hashes.SHA1 = '726cc1ca7f8046c14e21527415b52d1c952bea9c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727592d-5e50-4926-81ba-416e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:05.000Z",
|
|
"modified": "2016-05-02T13:42:05.000Z",
|
|
"first_observed": "2016-05-02T13:42:05Z",
|
|
"last_observed": "2016-05-02T13:42:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727592d-5e50-4926-81ba-416e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727592d-5e50-4926-81ba-416e02de0b81",
|
|
"value": "https://www.virustotal.com/file/3fdf9126e55826c7abbf5d191f93096b966a3e59cebff6f1f804c4153b62cc47/analysis/1381158712/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592d-cbcc-4138-b820-48c202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:05.000Z",
|
|
"modified": "2016-05-02T13:42:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 55d11e996ef37a99ddbedc9847dcc55b",
|
|
"pattern": "[file:hashes.SHA256 = 'a5d5d67e496a5c2cd9e2c073c6c7313a83e6380d6f0b1b626c545f24070b3c72']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592e-0d64-4af2-910a-472102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:06.000Z",
|
|
"modified": "2016-05-02T13:42:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 55d11e996ef37a99ddbedc9847dcc55b",
|
|
"pattern": "[file:hashes.SHA1 = '8e170ae89e1eeda9af2a720e86b46a826cc55251']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727592e-c53c-4e94-ae6b-414102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:06.000Z",
|
|
"modified": "2016-05-02T13:42:06.000Z",
|
|
"first_observed": "2016-05-02T13:42:06Z",
|
|
"last_observed": "2016-05-02T13:42:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727592e-c53c-4e94-ae6b-414102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727592e-c53c-4e94-ae6b-414102de0b81",
|
|
"value": "https://www.virustotal.com/file/a5d5d67e496a5c2cd9e2c073c6c7313a83e6380d6f0b1b626c545f24070b3c72/analysis/1412717288/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592e-95c0-4212-8b7a-4c4c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:06.000Z",
|
|
"modified": "2016-05-02T13:42:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5252efdc70dcbb53713454099fd10277",
|
|
"pattern": "[file:hashes.SHA256 = 'c0f1142ebb159b695c84b8dbb938d9af9c3a420dcfc18c223211b24423662beb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727592f-e0b8-4c9c-a089-4cc502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:07.000Z",
|
|
"modified": "2016-05-02T13:42:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 5252efdc70dcbb53713454099fd10277",
|
|
"pattern": "[file:hashes.SHA1 = 'd1df614b3b255703369a3c95fad0c035f40dba32']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727592f-54e4-4b59-8932-47b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:07.000Z",
|
|
"modified": "2016-05-02T13:42:07.000Z",
|
|
"first_observed": "2016-05-02T13:42:07Z",
|
|
"last_observed": "2016-05-02T13:42:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727592f-54e4-4b59-8932-47b602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727592f-54e4-4b59-8932-47b602de0b81",
|
|
"value": "https://www.virustotal.com/file/c0f1142ebb159b695c84b8dbb938d9af9c3a420dcfc18c223211b24423662beb/analysis/1394178874/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275930-4fb0-4874-8d15-488102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:08.000Z",
|
|
"modified": "2016-05-02T13:42:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 513b77a133f8d4f7c1e2a7ed150cd97c",
|
|
"pattern": "[file:hashes.SHA256 = 'fd6e68a119cf82dc116b53c26df5d27fbd01cb8b62f0005a7b3f1b7abed287a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275930-7c94-4e31-a38f-429002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:08.000Z",
|
|
"modified": "2016-05-02T13:42:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 513b77a133f8d4f7c1e2a7ed150cd97c",
|
|
"pattern": "[file:hashes.SHA1 = 'b10849c5747e25161a070130d51d13b11630ac71']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275930-716c-44dc-8487-42a202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:08.000Z",
|
|
"modified": "2016-05-02T13:42:08.000Z",
|
|
"first_observed": "2016-05-02T13:42:08Z",
|
|
"last_observed": "2016-05-02T13:42:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275930-716c-44dc-8487-42a202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275930-716c-44dc-8487-42a202de0b81",
|
|
"value": "https://www.virustotal.com/file/fd6e68a119cf82dc116b53c26df5d27fbd01cb8b62f0005a7b3f1b7abed287a5/analysis/1360231595/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275931-63ac-4e34-9ba9-44ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:09.000Z",
|
|
"modified": "2016-05-02T13:42:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4e768baed3dc75c224c6eb1671654e98",
|
|
"pattern": "[file:hashes.SHA256 = '24ce1ee07d868a39a849965bb393078dd2d01da529bf0a03257c384ce29c4734']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275931-99e8-4b3c-81f1-415902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:09.000Z",
|
|
"modified": "2016-05-02T13:42:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4e768baed3dc75c224c6eb1671654e98",
|
|
"pattern": "[file:hashes.SHA1 = '4a0bb9f56328ff4db275a051fb63ada14558202d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275932-0b0c-4a1b-a954-4c1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:10.000Z",
|
|
"modified": "2016-05-02T13:42:10.000Z",
|
|
"first_observed": "2016-05-02T13:42:10Z",
|
|
"last_observed": "2016-05-02T13:42:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275932-0b0c-4a1b-a954-4c1602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275932-0b0c-4a1b-a954-4c1602de0b81",
|
|
"value": "https://www.virustotal.com/file/24ce1ee07d868a39a849965bb393078dd2d01da529bf0a03257c384ce29c4734/analysis/1415479381/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275932-2e68-4736-a134-424802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:10.000Z",
|
|
"modified": "2016-05-02T13:42:10.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4b6e12709a2e708e682296d00383e0d8",
|
|
"pattern": "[file:hashes.SHA256 = '27e7b34a0af16a39ca68081db50a184abd2b1dfb92a9687e31ddb673120ce47d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275933-4354-419b-9c39-42f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:11.000Z",
|
|
"modified": "2016-05-02T13:42:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4b6e12709a2e708e682296d00383e0d8",
|
|
"pattern": "[file:hashes.SHA1 = '15ef251257cfce68f3ad2fc9d23d5291ee519b95']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275933-7890-4f73-8e61-4f7b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:11.000Z",
|
|
"modified": "2016-05-02T13:42:11.000Z",
|
|
"first_observed": "2016-05-02T13:42:11Z",
|
|
"last_observed": "2016-05-02T13:42:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275933-7890-4f73-8e61-4f7b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275933-7890-4f73-8e61-4f7b02de0b81",
|
|
"value": "https://www.virustotal.com/file/27e7b34a0af16a39ca68081db50a184abd2b1dfb92a9687e31ddb673120ce47d/analysis/1461326542/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275933-7828-4593-a19f-442002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:11.000Z",
|
|
"modified": "2016-05-02T13:42:11.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4ad5cc8dcf847be7c8787c02f06a5427",
|
|
"pattern": "[file:hashes.SHA256 = '935e9fce0422e6dcbb7b7462379c31ba01da3a6475e508ab5926c1bd340b0c02']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275934-9954-4ef6-aa29-419702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:12.000Z",
|
|
"modified": "2016-05-02T13:42:12.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4ad5cc8dcf847be7c8787c02f06a5427",
|
|
"pattern": "[file:hashes.SHA1 = 'ca72c05f1bdc4bb64861f0f1844292c0dcb4378a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275934-29f0-45f1-844e-49de02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:12.000Z",
|
|
"modified": "2016-05-02T13:42:12.000Z",
|
|
"first_observed": "2016-05-02T13:42:12Z",
|
|
"last_observed": "2016-05-02T13:42:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275934-29f0-45f1-844e-49de02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275934-29f0-45f1-844e-49de02de0b81",
|
|
"value": "https://www.virustotal.com/file/935e9fce0422e6dcbb7b7462379c31ba01da3a6475e508ab5926c1bd340b0c02/analysis/1460513277/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275935-d830-4d74-8fd6-48b402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:13.000Z",
|
|
"modified": "2016-05-02T13:42:13.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 48fe8cd9e6de8d5fae5f34785d4ac6d5",
|
|
"pattern": "[file:hashes.SHA256 = '4fcd2e28b02787bfe662cda517417d694e95f072f54140af68fe5345c5679a96']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275935-c4a8-4662-a0a5-459f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:13.000Z",
|
|
"modified": "2016-05-02T13:42:13.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 48fe8cd9e6de8d5fae5f34785d4ac6d5",
|
|
"pattern": "[file:hashes.SHA1 = 'a51ad699c85b2c88bae1d6682fd9fd7857e5ef5e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275935-fe30-4ad4-9aea-46ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:13.000Z",
|
|
"modified": "2016-05-02T13:42:13.000Z",
|
|
"first_observed": "2016-05-02T13:42:13Z",
|
|
"last_observed": "2016-05-02T13:42:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275935-fe30-4ad4-9aea-46ad02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275935-fe30-4ad4-9aea-46ad02de0b81",
|
|
"value": "https://www.virustotal.com/file/4fcd2e28b02787bfe662cda517417d694e95f072f54140af68fe5345c5679a96/analysis/1371813149/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275936-d4c8-4569-ad22-4ca102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:14.000Z",
|
|
"modified": "2016-05-02T13:42:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 47fcbd8058ec08f2da3ff184b4de0d79",
|
|
"pattern": "[file:hashes.SHA256 = '7e89d2426d3da1f8fcadaf3020e78f7fccdd3b3315d1c2d7ba2daeb821e2a272']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275936-c250-42b3-b442-468a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:14.000Z",
|
|
"modified": "2016-05-02T13:42:14.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 47fcbd8058ec08f2da3ff184b4de0d79",
|
|
"pattern": "[file:hashes.SHA1 = '7e7a872d85448635aed4190e0817961f018c0935']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275937-3a78-451a-8a55-4d6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:15.000Z",
|
|
"modified": "2016-05-02T13:42:15.000Z",
|
|
"first_observed": "2016-05-02T13:42:15Z",
|
|
"last_observed": "2016-05-02T13:42:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275937-3a78-451a-8a55-4d6d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275937-3a78-451a-8a55-4d6d02de0b81",
|
|
"value": "https://www.virustotal.com/file/7e89d2426d3da1f8fcadaf3020e78f7fccdd3b3315d1c2d7ba2daeb821e2a272/analysis/1458051677/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275937-eeec-4df3-bd5b-484202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:15.000Z",
|
|
"modified": "2016-05-02T13:42:15.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 44e6101ee0d2a267dd5a71de9ff3d49b",
|
|
"pattern": "[file:hashes.SHA256 = 'a075b1927f987149b037f33059ce7a1debccf01e416d49f479a2b79bb2af5e50']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275938-63d8-4451-a3e6-4d2c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:16.000Z",
|
|
"modified": "2016-05-02T13:42:16.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 44e6101ee0d2a267dd5a71de9ff3d49b",
|
|
"pattern": "[file:hashes.SHA1 = 'd263391d1a2252b1b905194b8984d13529470479']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275938-99c8-4afb-a109-427902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:16.000Z",
|
|
"modified": "2016-05-02T13:42:16.000Z",
|
|
"first_observed": "2016-05-02T13:42:16Z",
|
|
"last_observed": "2016-05-02T13:42:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275938-99c8-4afb-a109-427902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275938-99c8-4afb-a109-427902de0b81",
|
|
"value": "https://www.virustotal.com/file/a075b1927f987149b037f33059ce7a1debccf01e416d49f479a2b79bb2af5e50/analysis/1418501136/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275938-2f0c-47cc-a37f-4d1702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:16.000Z",
|
|
"modified": "2016-05-02T13:42:16.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4462402c80795fec584b0fef4b30ecf3",
|
|
"pattern": "[file:hashes.SHA256 = 'e4f8ce133d5c42e6c3adc09c120c2ec483a57e6839c6d9ee39e0b294102b867f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275939-1264-44e7-bc31-49ac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:17.000Z",
|
|
"modified": "2016-05-02T13:42:17.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 4462402c80795fec584b0fef4b30ecf3",
|
|
"pattern": "[file:hashes.SHA1 = 'e1594635c803869664092de0ffb1cfad21fe467a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275939-98f0-4269-9948-4e3702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:17.000Z",
|
|
"modified": "2016-05-02T13:42:17.000Z",
|
|
"first_observed": "2016-05-02T13:42:17Z",
|
|
"last_observed": "2016-05-02T13:42:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275939-98f0-4269-9948-4e3702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275939-98f0-4269-9948-4e3702de0b81",
|
|
"value": "https://www.virustotal.com/file/e4f8ce133d5c42e6c3adc09c120c2ec483a57e6839c6d9ee39e0b294102b867f/analysis/1417480660/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593a-f394-45a7-afc1-430102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:18.000Z",
|
|
"modified": "2016-05-02T13:42:18.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 43816893d27145e37cd3dbad22f29377",
|
|
"pattern": "[file:hashes.SHA256 = '754d1e666bc625f6349aa17f44aa1b0272d67d38acac686eb333326b59e1a999']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593a-8c20-4489-bf0e-4cfe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:18.000Z",
|
|
"modified": "2016-05-02T13:42:18.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 43816893d27145e37cd3dbad22f29377",
|
|
"pattern": "[file:hashes.SHA1 = '55f0015e739743cdba3f2bccb395b105f9fb1ca7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727593a-7ed4-4d30-bc93-4f0202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:18.000Z",
|
|
"modified": "2016-05-02T13:42:18.000Z",
|
|
"first_observed": "2016-05-02T13:42:18Z",
|
|
"last_observed": "2016-05-02T13:42:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727593a-7ed4-4d30-bc93-4f0202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727593a-7ed4-4d30-bc93-4f0202de0b81",
|
|
"value": "https://www.virustotal.com/file/754d1e666bc625f6349aa17f44aa1b0272d67d38acac686eb333326b59e1a999/analysis/1362134657/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593b-d868-4b0d-a84b-4aad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:19.000Z",
|
|
"modified": "2016-05-02T13:42:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 426a4471537a4d926a5b1f1119294787",
|
|
"pattern": "[file:hashes.SHA256 = '26ebcba28aae96dce11c38aedfafcd6fd53c267217e8ca7930144bf9fd07bdb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593b-2874-47d2-8e00-4b8202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:19.000Z",
|
|
"modified": "2016-05-02T13:42:19.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 426a4471537a4d926a5b1f1119294787",
|
|
"pattern": "[file:hashes.SHA1 = '6812bbf8824c862d3031d1af1f5f78f79f98c60f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727593c-30e4-45e2-96b1-461202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:20.000Z",
|
|
"modified": "2016-05-02T13:42:20.000Z",
|
|
"first_observed": "2016-05-02T13:42:20Z",
|
|
"last_observed": "2016-05-02T13:42:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727593c-30e4-45e2-96b1-461202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727593c-30e4-45e2-96b1-461202de0b81",
|
|
"value": "https://www.virustotal.com/file/26ebcba28aae96dce11c38aedfafcd6fd53c267217e8ca7930144bf9fd07bdb2/analysis/1358719950/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593c-e094-4811-a808-409602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:20.000Z",
|
|
"modified": "2016-05-02T13:42:20.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 403bfd88f3d24710993c9b1aaaab7ae2",
|
|
"pattern": "[file:hashes.SHA256 = '82ff5c03775689edf717094d9a97a8f4467aebcca15d4e47544c59829c2dc0a0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593c-eb34-4626-8785-44d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:20.000Z",
|
|
"modified": "2016-05-02T13:42:20.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 403bfd88f3d24710993c9b1aaaab7ae2",
|
|
"pattern": "[file:hashes.SHA1 = '26470a494906eccf8f1a90b75f0b3976c3b6083d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727593d-8994-48dc-8f1c-439602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:21.000Z",
|
|
"modified": "2016-05-02T13:42:21.000Z",
|
|
"first_observed": "2016-05-02T13:42:21Z",
|
|
"last_observed": "2016-05-02T13:42:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727593d-8994-48dc-8f1c-439602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727593d-8994-48dc-8f1c-439602de0b81",
|
|
"value": "https://www.virustotal.com/file/82ff5c03775689edf717094d9a97a8f4467aebcca15d4e47544c59829c2dc0a0/analysis/1359641136/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593d-d91c-4f19-8d85-4f8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:21.000Z",
|
|
"modified": "2016-05-02T13:42:21.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3f679d89e54f89a008bdd25d64cd46ed",
|
|
"pattern": "[file:hashes.SHA256 = '8fd958cc0e056bbbe79dde909c006f825acc4b38c32999c9c52fee484b77d778']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593e-57d0-4508-9c98-46d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:22.000Z",
|
|
"modified": "2016-05-02T13:42:22.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3f679d89e54f89a008bdd25d64cd46ed",
|
|
"pattern": "[file:hashes.SHA1 = 'f9b9648942cc6f5e0a6888464f15e42e4c0c53f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727593e-4be0-470e-ad2d-4fce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:22.000Z",
|
|
"modified": "2016-05-02T13:42:22.000Z",
|
|
"first_observed": "2016-05-02T13:42:22Z",
|
|
"last_observed": "2016-05-02T13:42:22Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727593e-4be0-470e-ad2d-4fce02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727593e-4be0-470e-ad2d-4fce02de0b81",
|
|
"value": "https://www.virustotal.com/file/8fd958cc0e056bbbe79dde909c006f825acc4b38c32999c9c52fee484b77d778/analysis/1460721654/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593f-be90-417d-8553-49a102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:23.000Z",
|
|
"modified": "2016-05-02T13:42:23.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3ecaacd6ccdcbb0fe149f68db964a308",
|
|
"pattern": "[file:hashes.SHA256 = '902f40d680a88db7f41cdaee60a895cfdc7c230531b2e6595156ada9117987f9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727593f-1ae4-4102-a6ee-48e102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:23.000Z",
|
|
"modified": "2016-05-02T13:42:23.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3ecaacd6ccdcbb0fe149f68db964a308",
|
|
"pattern": "[file:hashes.SHA1 = '0e8219d19a5ce1ae4772dda697d7236eefd0840d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727593f-5be8-44e8-9a50-411902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:23.000Z",
|
|
"modified": "2016-05-02T13:42:23.000Z",
|
|
"first_observed": "2016-05-02T13:42:23Z",
|
|
"last_observed": "2016-05-02T13:42:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727593f-5be8-44e8-9a50-411902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727593f-5be8-44e8-9a50-411902de0b81",
|
|
"value": "https://www.virustotal.com/file/902f40d680a88db7f41cdaee60a895cfdc7c230531b2e6595156ada9117987f9/analysis/1362160465/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275940-6ff4-4169-b4f7-455502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:24.000Z",
|
|
"modified": "2016-05-02T13:42:24.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3b2336e09cfea5e2c1c430ec371dcb0b",
|
|
"pattern": "[file:hashes.SHA256 = '3bda9557e13ac6017bd5e238267abd6bbcc0e2754bcd6c35bb1c0012982c9f06']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275940-96c4-4e7b-b317-4e4f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:24.000Z",
|
|
"modified": "2016-05-02T13:42:24.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 3b2336e09cfea5e2c1c430ec371dcb0b",
|
|
"pattern": "[file:hashes.SHA1 = '004f9173b449d5f62532eeb4fd2d2c17cc105501']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275941-eef8-4fc3-8a6e-4ee102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:25.000Z",
|
|
"modified": "2016-05-02T13:42:25.000Z",
|
|
"first_observed": "2016-05-02T13:42:25Z",
|
|
"last_observed": "2016-05-02T13:42:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275941-eef8-4fc3-8a6e-4ee102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275941-eef8-4fc3-8a6e-4ee102de0b81",
|
|
"value": "https://www.virustotal.com/file/3bda9557e13ac6017bd5e238267abd6bbcc0e2754bcd6c35bb1c0012982c9f06/analysis/1359810741/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275941-dff8-4753-aa72-420702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:25.000Z",
|
|
"modified": "2016-05-02T13:42:25.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 35d0338f6d82f97442c1da865b6bc644",
|
|
"pattern": "[file:hashes.SHA256 = '001dd4be4ff890db12a54c650f95b6bf0ba317483bbb0b707210f83189b03864']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275941-030c-4327-be7e-430102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:25.000Z",
|
|
"modified": "2016-05-02T13:42:25.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 35d0338f6d82f97442c1da865b6bc644",
|
|
"pattern": "[file:hashes.SHA1 = '7f73f4475a55a0cedf9146d9a4f1b9b9cde7d752']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275942-3664-4140-bfb6-45b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:26.000Z",
|
|
"modified": "2016-05-02T13:42:26.000Z",
|
|
"first_observed": "2016-05-02T13:42:26Z",
|
|
"last_observed": "2016-05-02T13:42:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275942-3664-4140-bfb6-45b102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275942-3664-4140-bfb6-45b102de0b81",
|
|
"value": "https://www.virustotal.com/file/001dd4be4ff890db12a54c650f95b6bf0ba317483bbb0b707210f83189b03864/analysis/1375073708/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275942-ffc4-4b5e-8589-42a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:26.000Z",
|
|
"modified": "2016-05-02T13:42:26.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 31e100ec9c9cf0ecef328a79b60a6455",
|
|
"pattern": "[file:hashes.SHA256 = '587aac84cf62c768b2d30131cc9f7ac2d9c73c874ca49961aa2b70c5227d43cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275943-54ac-47dd-a81b-480102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:27.000Z",
|
|
"modified": "2016-05-02T13:42:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 31e100ec9c9cf0ecef328a79b60a6455",
|
|
"pattern": "[file:hashes.SHA1 = '2bd1ee5271151a770dddbdb0b8601693d98ec9b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275943-e3d0-4fb1-8955-47eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:27.000Z",
|
|
"modified": "2016-05-02T13:42:27.000Z",
|
|
"first_observed": "2016-05-02T13:42:27Z",
|
|
"last_observed": "2016-05-02T13:42:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275943-e3d0-4fb1-8955-47eb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275943-e3d0-4fb1-8955-47eb02de0b81",
|
|
"value": "https://www.virustotal.com/file/587aac84cf62c768b2d30131cc9f7ac2d9c73c874ca49961aa2b70c5227d43cf/analysis/1401240496/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275943-cf18-409b-b4a0-4f8d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:27.000Z",
|
|
"modified": "2016-05-02T13:42:27.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 303b7700fb36ec54c20a0e2bef38a9cd",
|
|
"pattern": "[file:hashes.SHA256 = '48b5e5bdbc1e5fd2d46d85482888923bda6896eab491ad25fe0de4b84d68cc2a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275944-3048-465e-b5f8-4d8f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:28.000Z",
|
|
"modified": "2016-05-02T13:42:28.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 303b7700fb36ec54c20a0e2bef38a9cd",
|
|
"pattern": "[file:hashes.SHA1 = '02a9b4b8d2f5de0d2158a282cfc11133625460c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275944-edc4-44d7-8f97-4a8102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:28.000Z",
|
|
"modified": "2016-05-02T13:42:28.000Z",
|
|
"first_observed": "2016-05-02T13:42:28Z",
|
|
"last_observed": "2016-05-02T13:42:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275944-edc4-44d7-8f97-4a8102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275944-edc4-44d7-8f97-4a8102de0b81",
|
|
"value": "https://www.virustotal.com/file/48b5e5bdbc1e5fd2d46d85482888923bda6896eab491ad25fe0de4b84d68cc2a/analysis/1438014657/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275945-f24c-469c-a535-497202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:29.000Z",
|
|
"modified": "2016-05-02T13:42:29.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2fce0cc603d4a8b23c86d47bf55ad570",
|
|
"pattern": "[file:hashes.SHA256 = '9bfa0079c76773e5b09741d50d2f731a289bbe5b093f3d4f32a40c388e16b8cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275945-be34-4e76-a346-472f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:29.000Z",
|
|
"modified": "2016-05-02T13:42:29.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2fce0cc603d4a8b23c86d47bf55ad570",
|
|
"pattern": "[file:hashes.SHA1 = '87d34799ba73965a008a6c9c3ea793f729f04337']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275946-0168-4dab-afb2-4b2a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:30.000Z",
|
|
"modified": "2016-05-02T13:42:30.000Z",
|
|
"first_observed": "2016-05-02T13:42:30Z",
|
|
"last_observed": "2016-05-02T13:42:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275946-0168-4dab-afb2-4b2a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275946-0168-4dab-afb2-4b2a02de0b81",
|
|
"value": "https://www.virustotal.com/file/9bfa0079c76773e5b09741d50d2f731a289bbe5b093f3d4f32a40c388e16b8cd/analysis/1449334539/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275946-8cf4-4a63-bf70-4b1a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:30.000Z",
|
|
"modified": "2016-05-02T13:42:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2e4756bbc331661137b928e4a77e8c26",
|
|
"pattern": "[file:hashes.SHA256 = '9cd0d021d7cb1428150a941205d827046b78c9bd9e66dbd91f03aebf5135fa70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275946-7fec-4be2-840c-40fe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:30.000Z",
|
|
"modified": "2016-05-02T13:42:30.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2e4756bbc331661137b928e4a77e8c26",
|
|
"pattern": "[file:hashes.SHA1 = '2bc2cb5256a0642f4e0d188d7046ff885bcee8fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275947-8338-4ff2-b7c4-452502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:31.000Z",
|
|
"modified": "2016-05-02T13:42:31.000Z",
|
|
"first_observed": "2016-05-02T13:42:31Z",
|
|
"last_observed": "2016-05-02T13:42:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275947-8338-4ff2-b7c4-452502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275947-8338-4ff2-b7c4-452502de0b81",
|
|
"value": "https://www.virustotal.com/file/9cd0d021d7cb1428150a941205d827046b78c9bd9e66dbd91f03aebf5135fa70/analysis/1362162082/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275947-8374-47a3-af84-470d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:31.000Z",
|
|
"modified": "2016-05-02T13:42:31.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2c2a582705477443060d3277fb85e059",
|
|
"pattern": "[file:hashes.SHA256 = '0f9f7fb69adb116fe4f833fe65577f9b456ea1d1c600544a7da5c477a3ce983f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275948-2114-4727-bfe6-404502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:32.000Z",
|
|
"modified": "2016-05-02T13:42:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2c2a582705477443060d3277fb85e059",
|
|
"pattern": "[file:hashes.SHA1 = 'f2e85663f2ff82975c1c8502d0d331207881c8d6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275948-4e08-49dc-beba-4ce502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:32.000Z",
|
|
"modified": "2016-05-02T13:42:32.000Z",
|
|
"first_observed": "2016-05-02T13:42:32Z",
|
|
"last_observed": "2016-05-02T13:42:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275948-4e08-49dc-beba-4ce502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275948-4e08-49dc-beba-4ce502de0b81",
|
|
"value": "https://www.virustotal.com/file/0f9f7fb69adb116fe4f833fe65577f9b456ea1d1c600544a7da5c477a3ce983f/analysis/1401153589/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275948-bc08-4916-a597-42ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:32.000Z",
|
|
"modified": "2016-05-02T13:42:32.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2b2ef3be4cdb0c7046fc19965f5f37ff",
|
|
"pattern": "[file:hashes.SHA256 = '3c940d2d0cf6024b40d97cc80935e4450bf356f202c84544c851961bcfe8714b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275949-1ce8-4500-87b0-490d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:33.000Z",
|
|
"modified": "2016-05-02T13:42:33.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2b2ef3be4cdb0c7046fc19965f5f37ff",
|
|
"pattern": "[file:hashes.SHA1 = '059b541efcd1f6ea807899266d358dd1439568ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275949-b3b8-4a9c-a9e9-410b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:33.000Z",
|
|
"modified": "2016-05-02T13:42:33.000Z",
|
|
"first_observed": "2016-05-02T13:42:33Z",
|
|
"last_observed": "2016-05-02T13:42:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275949-b3b8-4a9c-a9e9-410b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275949-b3b8-4a9c-a9e9-410b02de0b81",
|
|
"value": "https://www.virustotal.com/file/3c940d2d0cf6024b40d97cc80935e4450bf356f202c84544c851961bcfe8714b/analysis/1377521926/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594a-281c-4c97-9597-424502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:34.000Z",
|
|
"modified": "2016-05-02T13:42:34.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2a817c1d6bad99430c9eace0a6008a75",
|
|
"pattern": "[file:hashes.SHA256 = '663fd4a1cd54ea914b842270356bf7c7f7e72203fe4a9ea64c19368b84057667']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594a-ad60-4b23-ba93-4d0e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:34.000Z",
|
|
"modified": "2016-05-02T13:42:34.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2a817c1d6bad99430c9eace0a6008a75",
|
|
"pattern": "[file:hashes.SHA1 = '87060ce20637f81ed3e288399b64ad88118502a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727594b-3238-416d-a563-44a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:34.000Z",
|
|
"modified": "2016-05-02T13:42:34.000Z",
|
|
"first_observed": "2016-05-02T13:42:34Z",
|
|
"last_observed": "2016-05-02T13:42:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727594b-3238-416d-a563-44a902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727594b-3238-416d-a563-44a902de0b81",
|
|
"value": "https://www.virustotal.com/file/663fd4a1cd54ea914b842270356bf7c7f7e72203fe4a9ea64c19368b84057667/analysis/1360508007/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594b-f254-462a-84bd-45c202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:35.000Z",
|
|
"modified": "2016-05-02T13:42:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2a7bea7f4391327c7d3f9bae58e40c03",
|
|
"pattern": "[file:hashes.SHA256 = '7a778f295dabe7344e15b418e2f57594e78818b7d3868a1e06cd75555087e863']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594b-97b4-4fc1-894f-448a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:35.000Z",
|
|
"modified": "2016-05-02T13:42:35.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 2a7bea7f4391327c7d3f9bae58e40c03",
|
|
"pattern": "[file:hashes.SHA1 = '7e94fcf6d0158cf0053f18354eaf9d344a181754']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727594c-f9d0-43dc-86e6-454002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:36.000Z",
|
|
"modified": "2016-05-02T13:42:36.000Z",
|
|
"first_observed": "2016-05-02T13:42:36Z",
|
|
"last_observed": "2016-05-02T13:42:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727594c-f9d0-43dc-86e6-454002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727594c-f9d0-43dc-86e6-454002de0b81",
|
|
"value": "https://www.virustotal.com/file/7a778f295dabe7344e15b418e2f57594e78818b7d3868a1e06cd75555087e863/analysis/1361131004/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594c-f120-4529-999e-4f0102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:36.000Z",
|
|
"modified": "2016-05-02T13:42:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 29cc209a96cea4fe241373c784fed35c",
|
|
"pattern": "[file:hashes.SHA256 = '8ad1690850762ce9ac2df8fc108d32af805f75206ed93b8b3c4c2b4e04da62f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594c-375c-465c-8db1-4d7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:36.000Z",
|
|
"modified": "2016-05-02T13:42:36.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 29cc209a96cea4fe241373c784fed35c",
|
|
"pattern": "[file:hashes.SHA1 = 'bdca288b4012e44f0b8ab256162a4d89a69b9a32']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727594d-1a2c-4059-a581-449702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:37.000Z",
|
|
"modified": "2016-05-02T13:42:37.000Z",
|
|
"first_observed": "2016-05-02T13:42:37Z",
|
|
"last_observed": "2016-05-02T13:42:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727594d-1a2c-4059-a581-449702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727594d-1a2c-4059-a581-449702de0b81",
|
|
"value": "https://www.virustotal.com/file/8ad1690850762ce9ac2df8fc108d32af805f75206ed93b8b3c4c2b4e04da62f1/analysis/1431587871/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594d-9c54-40cf-945d-4b6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:37.000Z",
|
|
"modified": "2016-05-02T13:42:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 25fee0f3a3296a624db0dff85fbddb79",
|
|
"pattern": "[file:hashes.SHA256 = '1c200a6b134b4029510b45a3a71dc68cf2791c8b1f0985bedf8be41995041a55']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594d-14a8-4837-9874-459802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:37.000Z",
|
|
"modified": "2016-05-02T13:42:37.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 25fee0f3a3296a624db0dff85fbddb79",
|
|
"pattern": "[file:hashes.SHA1 = 'e8fc83824e9ebe52893d6abc736edc9ec4cd7c29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727594e-5278-4066-a0ac-4ede02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:38.000Z",
|
|
"modified": "2016-05-02T13:42:38.000Z",
|
|
"first_observed": "2016-05-02T13:42:38Z",
|
|
"last_observed": "2016-05-02T13:42:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727594e-5278-4066-a0ac-4ede02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727594e-5278-4066-a0ac-4ede02de0b81",
|
|
"value": "https://www.virustotal.com/file/1c200a6b134b4029510b45a3a71dc68cf2791c8b1f0985bedf8be41995041a55/analysis/1425899557/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594e-49c4-4ab8-981b-47be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:38.000Z",
|
|
"modified": "2016-05-02T13:42:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1f6886dd68f7d1e02f6de08d43432487",
|
|
"pattern": "[file:hashes.SHA256 = '3821bb3594c35f82dcab1423019e997cb4d7f66ac4ce96a41ec0260c6ac8eb84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594e-ff04-4c45-a42c-4a3802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:38.000Z",
|
|
"modified": "2016-05-02T13:42:38.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1f6886dd68f7d1e02f6de08d43432487",
|
|
"pattern": "[file:hashes.SHA1 = 'e4123d66c59397aa9031524f2c93760815a34a74']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727594f-7a50-4c59-a1a5-41af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:39.000Z",
|
|
"modified": "2016-05-02T13:42:39.000Z",
|
|
"first_observed": "2016-05-02T13:42:39Z",
|
|
"last_observed": "2016-05-02T13:42:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727594f-7a50-4c59-a1a5-41af02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727594f-7a50-4c59-a1a5-41af02de0b81",
|
|
"value": "https://www.virustotal.com/file/3821bb3594c35f82dcab1423019e997cb4d7f66ac4ce96a41ec0260c6ac8eb84/analysis/1458288765/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594f-741c-454d-9987-45bb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:39.000Z",
|
|
"modified": "2016-05-02T13:42:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1a8c12cb5a07aae016d33015f589bfb2",
|
|
"pattern": "[file:hashes.SHA256 = 'e50e036454da74afc436db6a3552afd63b56dd5b6e59e94e6a5cc54e32919114']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727594f-8168-4304-b460-4ffc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:39.000Z",
|
|
"modified": "2016-05-02T13:42:39.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1a8c12cb5a07aae016d33015f589bfb2",
|
|
"pattern": "[file:hashes.SHA1 = '275be4a4dc1446106df845790e6c6d845b1e4a83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275950-e940-4286-8492-4b7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:40.000Z",
|
|
"modified": "2016-05-02T13:42:40.000Z",
|
|
"first_observed": "2016-05-02T13:42:40Z",
|
|
"last_observed": "2016-05-02T13:42:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275950-e940-4286-8492-4b7502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275950-e940-4286-8492-4b7502de0b81",
|
|
"value": "https://www.virustotal.com/file/e50e036454da74afc436db6a3552afd63b56dd5b6e59e94e6a5cc54e32919114/analysis/1362068385/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275950-cef8-437e-9fc9-4f9502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:40.000Z",
|
|
"modified": "2016-05-02T13:42:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1955f324552812e3fc8f4513cc058674",
|
|
"pattern": "[file:hashes.SHA256 = 'd4dcab7fa63ffaca0a1813ceb5fa5a6d03016c274f209af92a76840c485a0808']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275950-bc30-4754-827e-49ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:40.000Z",
|
|
"modified": "2016-05-02T13:42:40.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1955f324552812e3fc8f4513cc058674",
|
|
"pattern": "[file:hashes.SHA1 = '5635a0ccc3260bbc76f1d9d52ea1588180df93c8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275951-ac30-43e9-98c4-47b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:41.000Z",
|
|
"modified": "2016-05-02T13:42:41.000Z",
|
|
"first_observed": "2016-05-02T13:42:41Z",
|
|
"last_observed": "2016-05-02T13:42:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275951-ac30-43e9-98c4-47b102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275951-ac30-43e9-98c4-47b102de0b81",
|
|
"value": "https://www.virustotal.com/file/d4dcab7fa63ffaca0a1813ceb5fa5a6d03016c274f209af92a76840c485a0808/analysis/1429838449/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275951-b854-4d28-9800-48ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:41.000Z",
|
|
"modified": "2016-05-02T13:42:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 190d4104d774527106fa28d5df4e3fd2",
|
|
"pattern": "[file:hashes.SHA256 = '10b51f5ae6f2ccc5e4ef4a93eab6638e3dfaf7e21f8747a96530bf98f9c6acd5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275951-9830-45e2-ad0e-42fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:41.000Z",
|
|
"modified": "2016-05-02T13:42:41.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 190d4104d774527106fa28d5df4e3fd2",
|
|
"pattern": "[file:hashes.SHA1 = '7a2a7de73fa857c77048e6617da1cd52579cb29c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275952-bff8-48b2-a240-4ff702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:42.000Z",
|
|
"modified": "2016-05-02T13:42:42.000Z",
|
|
"first_observed": "2016-05-02T13:42:42Z",
|
|
"last_observed": "2016-05-02T13:42:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275952-bff8-48b2-a240-4ff702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275952-bff8-48b2-a240-4ff702de0b81",
|
|
"value": "https://www.virustotal.com/file/10b51f5ae6f2ccc5e4ef4a93eab6638e3dfaf7e21f8747a96530bf98f9c6acd5/analysis/1365874498/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275952-4730-4cdb-a90e-4c3102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:42.000Z",
|
|
"modified": "2016-05-02T13:42:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1906dc3bc8d5086af55ad7902a550d45",
|
|
"pattern": "[file:hashes.SHA256 = '8e0cfcdda3979df0075bd32aff8449180dbd61a04ff58b14fa8c74c5d6e028e5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275952-346c-4c90-baa6-489a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:42.000Z",
|
|
"modified": "2016-05-02T13:42:42.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1906dc3bc8d5086af55ad7902a550d45",
|
|
"pattern": "[file:hashes.SHA1 = '6c4a2154e6fa3ae0a5dec5176a6abbd0214a4c00']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275953-9c40-4b40-acdb-449102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:43.000Z",
|
|
"modified": "2016-05-02T13:42:43.000Z",
|
|
"first_observed": "2016-05-02T13:42:43Z",
|
|
"last_observed": "2016-05-02T13:42:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275953-9c40-4b40-acdb-449102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275953-9c40-4b40-acdb-449102de0b81",
|
|
"value": "https://www.virustotal.com/file/8e0cfcdda3979df0075bd32aff8449180dbd61a04ff58b14fa8c74c5d6e028e5/analysis/1362163885/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275953-68ec-467a-b904-4f8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:43.000Z",
|
|
"modified": "2016-05-02T13:42:43.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 18713529ff40b366b162c276333b62ce",
|
|
"pattern": "[file:hashes.SHA256 = '099e2d18e63b1e845b1f3984da8affdf8a1b9e5c15666812d1f58ffafe19a6e5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275954-4724-4934-a8b8-4b5802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:44.000Z",
|
|
"modified": "2016-05-02T13:42:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 18713529ff40b366b162c276333b62ce",
|
|
"pattern": "[file:hashes.SHA1 = '7ae8b112330c63bf702df646fc1a03f2eae7cec8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275954-a7f4-4dfc-809d-47b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:44.000Z",
|
|
"modified": "2016-05-02T13:42:44.000Z",
|
|
"first_observed": "2016-05-02T13:42:44Z",
|
|
"last_observed": "2016-05-02T13:42:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275954-a7f4-4dfc-809d-47b602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275954-a7f4-4dfc-809d-47b602de0b81",
|
|
"value": "https://www.virustotal.com/file/099e2d18e63b1e845b1f3984da8affdf8a1b9e5c15666812d1f58ffafe19a6e5/analysis/1360945423/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275954-bd24-459b-81e2-4ea702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:44.000Z",
|
|
"modified": "2016-05-02T13:42:44.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1831809c397b0c285146df1335efbf5f",
|
|
"pattern": "[file:hashes.SHA256 = 'ae351df6512c8c906f6c0e9b1f62a71693285a0a2c741d65a10ee068c8a4e87a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275955-4a4c-407c-a076-4dce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:45.000Z",
|
|
"modified": "2016-05-02T13:42:45.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1831809c397b0c285146df1335efbf5f",
|
|
"pattern": "[file:hashes.SHA1 = 'b0985d52b0a2947096234cae9f372eb2dff4345d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275955-db64-46d5-8bf3-474c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:45.000Z",
|
|
"modified": "2016-05-02T13:42:45.000Z",
|
|
"first_observed": "2016-05-02T13:42:45Z",
|
|
"last_observed": "2016-05-02T13:42:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275955-db64-46d5-8bf3-474c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275955-db64-46d5-8bf3-474c02de0b81",
|
|
"value": "https://www.virustotal.com/file/ae351df6512c8c906f6c0e9b1f62a71693285a0a2c741d65a10ee068c8a4e87a/analysis/1376110419/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275956-d69c-4a98-b783-427302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:46.000Z",
|
|
"modified": "2016-05-02T13:42:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 16089210258939642c427188e70b3c2b",
|
|
"pattern": "[file:hashes.SHA256 = '4eaab2b0aa1c6e4306a0decf33c8e69a1e1c35def2fcaa49a0e744bb3e2b6c52']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275956-1760-432e-a9b1-41c002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:46.000Z",
|
|
"modified": "2016-05-02T13:42:46.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 16089210258939642c427188e70b3c2b",
|
|
"pattern": "[file:hashes.SHA1 = '94d03ccd8155d434a1a25fb97494945f28084e38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275957-f73c-4ec3-88a5-4bc002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:47.000Z",
|
|
"modified": "2016-05-02T13:42:47.000Z",
|
|
"first_observed": "2016-05-02T13:42:47Z",
|
|
"last_observed": "2016-05-02T13:42:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275957-f73c-4ec3-88a5-4bc002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275957-f73c-4ec3-88a5-4bc002de0b81",
|
|
"value": "https://www.virustotal.com/file/4eaab2b0aa1c6e4306a0decf33c8e69a1e1c35def2fcaa49a0e744bb3e2b6c52/analysis/1450442736/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275957-9e44-4b9d-aab2-4c6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:47.000Z",
|
|
"modified": "2016-05-02T13:42:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 13eb94e02912da06072246789aa1a8a8",
|
|
"pattern": "[file:hashes.SHA256 = 'dfd2ea217afe96529b4c72fb1a40425b774a508989f8d31696f7e36b0d19f2df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275957-7c78-4016-b1c9-495e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:47.000Z",
|
|
"modified": "2016-05-02T13:42:47.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 13eb94e02912da06072246789aa1a8a8",
|
|
"pattern": "[file:hashes.SHA1 = 'ba92c60506f63925bac21b685d7657541a243a0f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275958-8f7c-4353-8da3-491602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:48.000Z",
|
|
"modified": "2016-05-02T13:42:48.000Z",
|
|
"first_observed": "2016-05-02T13:42:48Z",
|
|
"last_observed": "2016-05-02T13:42:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275958-8f7c-4353-8da3-491602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275958-8f7c-4353-8da3-491602de0b81",
|
|
"value": "https://www.virustotal.com/file/dfd2ea217afe96529b4c72fb1a40425b774a508989f8d31696f7e36b0d19f2df/analysis/1361463057/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275958-0038-40e7-84d4-42c902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:48.000Z",
|
|
"modified": "2016-05-02T13:42:48.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12d2cab3480c706f956da4a22c15ddb3",
|
|
"pattern": "[file:hashes.SHA256 = '45bc3b26b1e16120ff9cf906b0672b5bea13d196313a0cd53ced40b042d2d56f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275959-7ba8-4fc8-9907-413402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:49.000Z",
|
|
"modified": "2016-05-02T13:42:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12d2cab3480c706f956da4a22c15ddb3",
|
|
"pattern": "[file:hashes.SHA1 = 'ba77c6928658ada938113630e53551c6b9650598']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275959-6cc4-480c-b570-44c002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:49.000Z",
|
|
"modified": "2016-05-02T13:42:49.000Z",
|
|
"first_observed": "2016-05-02T13:42:49Z",
|
|
"last_observed": "2016-05-02T13:42:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275959-6cc4-480c-b570-44c002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275959-6cc4-480c-b570-44c002de0b81",
|
|
"value": "https://www.virustotal.com/file/45bc3b26b1e16120ff9cf906b0672b5bea13d196313a0cd53ced40b042d2d56f/analysis/1404818757/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275959-ebb4-431b-8f52-460402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:49.000Z",
|
|
"modified": "2016-05-02T13:42:49.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12b6ce12e581aca530324bcd256de512",
|
|
"pattern": "[file:hashes.SHA256 = '15a3423b8048bf614beabcd868a234e7fc4b2f3bc77805934318986d11315ae7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595a-7184-45fd-a3a4-4c3402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:50.000Z",
|
|
"modified": "2016-05-02T13:42:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12b6ce12e581aca530324bcd256de512",
|
|
"pattern": "[file:hashes.SHA1 = '0b4bca9dbf5e10f10108040e1793bc09a906c4c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595a-9994-472b-aa50-4c7102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:50.000Z",
|
|
"modified": "2016-05-02T13:42:50.000Z",
|
|
"first_observed": "2016-05-02T13:42:50Z",
|
|
"last_observed": "2016-05-02T13:42:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595a-9994-472b-aa50-4c7102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595a-9994-472b-aa50-4c7102de0b81",
|
|
"value": "https://www.virustotal.com/file/15a3423b8048bf614beabcd868a234e7fc4b2f3bc77805934318986d11315ae7/analysis/1359109480/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595a-6964-4717-8c6e-478002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:50.000Z",
|
|
"modified": "2016-05-02T13:42:50.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12973584deae59421ed99e3adde993ee",
|
|
"pattern": "[file:hashes.SHA256 = '54e87a9ca87ec9cc6bea62b4994c60714424224a2dcd4c1df83af451580c488d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595b-d704-4f84-b12d-41a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:51.000Z",
|
|
"modified": "2016-05-02T13:42:51.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 12973584deae59421ed99e3adde993ee",
|
|
"pattern": "[file:hashes.SHA1 = '01a54e50b502e6be678a161e7362736c56f01413']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595b-b6b8-471e-b853-447402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:51.000Z",
|
|
"modified": "2016-05-02T13:42:51.000Z",
|
|
"first_observed": "2016-05-02T13:42:51Z",
|
|
"last_observed": "2016-05-02T13:42:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595b-b6b8-471e-b853-447402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595b-b6b8-471e-b853-447402de0b81",
|
|
"value": "https://www.virustotal.com/file/54e87a9ca87ec9cc6bea62b4994c60714424224a2dcd4c1df83af451580c488d/analysis/1433591850/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595c-14b0-4a66-a255-4f0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:52.000Z",
|
|
"modified": "2016-05-02T13:42:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 123506172c5d84d2c2d046edd66a57c0",
|
|
"pattern": "[file:hashes.SHA256 = '4843073e4758427640aa1193f7d30d4a470f18d80680f0fb987ae723b83faa29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595c-2bf4-4e23-8931-460002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:52.000Z",
|
|
"modified": "2016-05-02T13:42:52.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 123506172c5d84d2c2d046edd66a57c0",
|
|
"pattern": "[file:hashes.SHA1 = 'f50075983a7aec111a107c7727f3bb335f4e3964']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595c-1f84-4c0b-9673-407902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:52.000Z",
|
|
"modified": "2016-05-02T13:42:52.000Z",
|
|
"first_observed": "2016-05-02T13:42:52Z",
|
|
"last_observed": "2016-05-02T13:42:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595c-1f84-4c0b-9673-407902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595c-1f84-4c0b-9673-407902de0b81",
|
|
"value": "https://www.virustotal.com/file/4843073e4758427640aa1193f7d30d4a470f18d80680f0fb987ae723b83faa29/analysis/1458288764/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595d-0378-4af1-b06c-438c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:53.000Z",
|
|
"modified": "2016-05-02T13:42:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 10eee810f70b9aee5d2784b79539f880",
|
|
"pattern": "[file:hashes.SHA256 = 'b15bca57ec7fad78618b2c6d4be709755e00d665da258a188e6bbdf9db5997ea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595d-06c0-4758-830a-423702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:53.000Z",
|
|
"modified": "2016-05-02T13:42:53.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 10eee810f70b9aee5d2784b79539f880",
|
|
"pattern": "[file:hashes.SHA1 = 'bd3fa3c26b9bf7840df543becd19b56292aab60c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595d-609c-40c6-9b8d-4bd202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:53.000Z",
|
|
"modified": "2016-05-02T13:42:53.000Z",
|
|
"first_observed": "2016-05-02T13:42:53Z",
|
|
"last_observed": "2016-05-02T13:42:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595d-609c-40c6-9b8d-4bd202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595d-609c-40c6-9b8d-4bd202de0b81",
|
|
"value": "https://www.virustotal.com/file/b15bca57ec7fad78618b2c6d4be709755e00d665da258a188e6bbdf9db5997ea/analysis/1378982271/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595e-02a4-4882-9e47-426802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:54.000Z",
|
|
"modified": "2016-05-02T13:42:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 10edd365e7353200c88c4fa2595a1c57",
|
|
"pattern": "[file:hashes.SHA256 = 'aa17a8858644232a16479bd028185e119dd9ff6c13dc652ca9867249bf8fe631']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595e-0874-4e72-927e-497702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:54.000Z",
|
|
"modified": "2016-05-02T13:42:54.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 10edd365e7353200c88c4fa2595a1c57",
|
|
"pattern": "[file:hashes.SHA1 = '1d1150b3954ecb8623ac5f26310a75c1f5c24c28']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595e-a918-4024-9ffc-4ade02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:54.000Z",
|
|
"modified": "2016-05-02T13:42:54.000Z",
|
|
"first_observed": "2016-05-02T13:42:54Z",
|
|
"last_observed": "2016-05-02T13:42:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595e-a918-4024-9ffc-4ade02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595e-a918-4024-9ffc-4ade02de0b81",
|
|
"value": "https://www.virustotal.com/file/aa17a8858644232a16479bd028185e119dd9ff6c13dc652ca9867249bf8fe631/analysis/1376120797/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595f-6d30-4d1d-8590-485d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:55.000Z",
|
|
"modified": "2016-05-02T13:42:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 109f613a3db75b78a8f2fc4f4d9c1aa3",
|
|
"pattern": "[file:hashes.SHA256 = 'caf331546d46d5a6531fcacbb32f94f02dc98f7f71995c0d65c8c61b327fb3bb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727595f-6bcc-409a-aecf-4cb502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:55.000Z",
|
|
"modified": "2016-05-02T13:42:55.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 109f613a3db75b78a8f2fc4f4d9c1aa3",
|
|
"pattern": "[file:hashes.SHA1 = '5462ece8ac16d6ce21e396542e58b2c90949fd98']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727595f-166c-4563-a988-409202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:55.000Z",
|
|
"modified": "2016-05-02T13:42:55.000Z",
|
|
"first_observed": "2016-05-02T13:42:55Z",
|
|
"last_observed": "2016-05-02T13:42:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727595f-166c-4563-a988-409202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727595f-166c-4563-a988-409202de0b81",
|
|
"value": "https://www.virustotal.com/file/caf331546d46d5a6531fcacbb32f94f02dc98f7f71995c0d65c8c61b327fb3bb/analysis/1404294556/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275960-9bd0-48b9-97f7-49ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:56.000Z",
|
|
"modified": "2016-05-02T13:42:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1018960f13469a54e48eb4468b119d24",
|
|
"pattern": "[file:hashes.SHA256 = '2ddb74fe0d7a1f6f633dbe575aaf7298085b414fdfc343ab26fc939fa7c0e76f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275960-301c-4518-aa86-479b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:56.000Z",
|
|
"modified": "2016-05-02T13:42:56.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 1018960f13469a54e48eb4468b119d24",
|
|
"pattern": "[file:hashes.SHA1 = 'a7c7526aec2e4a03d489868b2601d33a48f7290b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275960-4fd8-4622-9f89-422c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:56.000Z",
|
|
"modified": "2016-05-02T13:42:56.000Z",
|
|
"first_observed": "2016-05-02T13:42:56Z",
|
|
"last_observed": "2016-05-02T13:42:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275960-4fd8-4622-9f89-422c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275960-4fd8-4622-9f89-422c02de0b81",
|
|
"value": "https://www.virustotal.com/file/2ddb74fe0d7a1f6f633dbe575aaf7298085b414fdfc343ab26fc939fa7c0e76f/analysis/1452986878/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275961-37a8-4ca5-b4b1-4c0702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:57.000Z",
|
|
"modified": "2016-05-02T13:42:57.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0d7909ab4f933b56f7727726c2b1aa78",
|
|
"pattern": "[file:hashes.SHA256 = 'c8fafb608a16211ef384a0b26a647cf81cbfd84ac274b45a5107ce568afe3ae1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275961-016c-47c0-b6f1-472f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:57.000Z",
|
|
"modified": "2016-05-02T13:42:57.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0d7909ab4f933b56f7727726c2b1aa78",
|
|
"pattern": "[file:hashes.SHA1 = '4131897b2d8dcad0a5f27fa0f750f45b76128cb1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275961-8d9c-40e6-bebf-40af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:57.000Z",
|
|
"modified": "2016-05-02T13:42:57.000Z",
|
|
"first_observed": "2016-05-02T13:42:57Z",
|
|
"last_observed": "2016-05-02T13:42:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275961-8d9c-40e6-bebf-40af02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275961-8d9c-40e6-bebf-40af02de0b81",
|
|
"value": "https://www.virustotal.com/file/c8fafb608a16211ef384a0b26a647cf81cbfd84ac274b45a5107ce568afe3ae1/analysis/1397783739/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275962-5858-4a5a-b601-487002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:58.000Z",
|
|
"modified": "2016-05-02T13:42:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0c4794ee8211d030fbaf72ffd028b302",
|
|
"pattern": "[file:hashes.SHA256 = '7a034f6ad033a72b34c736b7d7d19d887b8d6d7a26bc67c16c70c110932f756a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275962-922c-4b7f-a35b-45c102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:58.000Z",
|
|
"modified": "2016-05-02T13:42:58.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0c4794ee8211d030fbaf72ffd028b302",
|
|
"pattern": "[file:hashes.SHA1 = '40651c5a03052af8b4c7cb576cce8057efc49b29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275962-5a68-403e-a3f4-483902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:58.000Z",
|
|
"modified": "2016-05-02T13:42:58.000Z",
|
|
"first_observed": "2016-05-02T13:42:58Z",
|
|
"last_observed": "2016-05-02T13:42:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275962-5a68-403e-a3f4-483902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275962-5a68-403e-a3f4-483902de0b81",
|
|
"value": "https://www.virustotal.com/file/7a034f6ad033a72b34c736b7d7d19d887b8d6d7a26bc67c16c70c110932f756a/analysis/1440169564/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275963-a6d0-4e4d-9869-48f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:59.000Z",
|
|
"modified": "2016-05-02T13:42:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0bec1d0a2487653801ed24422a89433b",
|
|
"pattern": "[file:hashes.SHA256 = '36d8e7052ee89d71ecb0c1d64359bc12fafe573b9a316ff15528cacf326b51ed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275963-293c-46a5-8228-4d4e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:59.000Z",
|
|
"modified": "2016-05-02T13:42:59.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0bec1d0a2487653801ed24422a89433b",
|
|
"pattern": "[file:hashes.SHA1 = '3a6056f3b6489b6858f3bf0e218ec6f1a8b78815']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:42:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275963-efdc-468c-85a4-4a0b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:42:59.000Z",
|
|
"modified": "2016-05-02T13:42:59.000Z",
|
|
"first_observed": "2016-05-02T13:42:59Z",
|
|
"last_observed": "2016-05-02T13:42:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275963-efdc-468c-85a4-4a0b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275963-efdc-468c-85a4-4a0b02de0b81",
|
|
"value": "https://www.virustotal.com/file/36d8e7052ee89d71ecb0c1d64359bc12fafe573b9a316ff15528cacf326b51ed/analysis/1399029276/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275964-f434-4c64-8f12-4d1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:00.000Z",
|
|
"modified": "2016-05-02T13:43:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0b3ee491ac8a3a4f67a3981bbcd773a9",
|
|
"pattern": "[file:hashes.SHA256 = 'd0f74a849dea2e7e3212c155d61418a2d7c328781180b88fd26edb9477d12b00']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275964-ded8-4b06-a246-423f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:00.000Z",
|
|
"modified": "2016-05-02T13:43:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0b3ee491ac8a3a4f67a3981bbcd773a9",
|
|
"pattern": "[file:hashes.SHA1 = 'ce977012bed9fbcf3bbdb2faf34bb9d6527c6f7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275964-ccc0-4fb3-9198-43a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:00.000Z",
|
|
"modified": "2016-05-02T13:43:00.000Z",
|
|
"first_observed": "2016-05-02T13:43:00Z",
|
|
"last_observed": "2016-05-02T13:43:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275964-ccc0-4fb3-9198-43a802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275964-ccc0-4fb3-9198-43a802de0b81",
|
|
"value": "https://www.virustotal.com/file/d0f74a849dea2e7e3212c155d61418a2d7c328781180b88fd26edb9477d12b00/analysis/1365796387/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275964-e90c-4e02-b82d-4b6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:00.000Z",
|
|
"modified": "2016-05-02T13:43:00.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0a07888d4ad0ba8c83e8cbe555ba7810",
|
|
"pattern": "[file:hashes.SHA256 = '4f5a7a64a167f2e4403d67cb65bd0db45edb661f3ea4f6eaf47e89522a74576b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275965-bde0-40b3-845f-47ee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:01.000Z",
|
|
"modified": "2016-05-02T13:43:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0a07888d4ad0ba8c83e8cbe555ba7810",
|
|
"pattern": "[file:hashes.SHA1 = '231f75ec0e611403e1cdeac5e0bb3fef398e76ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275965-0ba4-4bab-8925-458302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:01.000Z",
|
|
"modified": "2016-05-02T13:43:01.000Z",
|
|
"first_observed": "2016-05-02T13:43:01Z",
|
|
"last_observed": "2016-05-02T13:43:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275965-0ba4-4bab-8925-458302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275965-0ba4-4bab-8925-458302de0b81",
|
|
"value": "https://www.virustotal.com/file/4f5a7a64a167f2e4403d67cb65bd0db45edb661f3ea4f6eaf47e89522a74576b/analysis/1399343865/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275965-5a50-4c87-a103-40d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:01.000Z",
|
|
"modified": "2016-05-02T13:43:01.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 09f8655f862f0074b6648df4dd2bcc8b",
|
|
"pattern": "[file:hashes.SHA256 = '23b58da4866b7a1ad7077fd5964c5cc722f8405fcfbc3da9d8e504598bc65a6b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275966-77cc-41ca-a96c-487502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:02.000Z",
|
|
"modified": "2016-05-02T13:43:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 09f8655f862f0074b6648df4dd2bcc8b",
|
|
"pattern": "[file:hashes.SHA1 = '5248b0eb5f568fab79208c49f3da2715e3aaa89a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275966-6e84-457b-93b1-465f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:02.000Z",
|
|
"modified": "2016-05-02T13:43:02.000Z",
|
|
"first_observed": "2016-05-02T13:43:02Z",
|
|
"last_observed": "2016-05-02T13:43:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275966-6e84-457b-93b1-465f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275966-6e84-457b-93b1-465f02de0b81",
|
|
"value": "https://www.virustotal.com/file/23b58da4866b7a1ad7077fd5964c5cc722f8405fcfbc3da9d8e504598bc65a6b/analysis/1385926331/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275966-e334-4d4e-8b50-429502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:02.000Z",
|
|
"modified": "2016-05-02T13:43:02.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 06a3cdf1f52bbbbc3fbddbd80366c459",
|
|
"pattern": "[file:hashes.SHA256 = '278daf9d3ec640505af292b30e4b176f1b9a82a3784d29b6c1f627038455cd88']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275967-89b4-4a28-9b51-48e102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:03.000Z",
|
|
"modified": "2016-05-02T13:43:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 06a3cdf1f52bbbbc3fbddbd80366c459",
|
|
"pattern": "[file:hashes.SHA1 = 'baff2cbe7d248f875cbe527ecfeb74b04dba9f1d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275967-3cac-4754-bcb2-46b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:03.000Z",
|
|
"modified": "2016-05-02T13:43:03.000Z",
|
|
"first_observed": "2016-05-02T13:43:03Z",
|
|
"last_observed": "2016-05-02T13:43:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275967-3cac-4754-bcb2-46b902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275967-3cac-4754-bcb2-46b902de0b81",
|
|
"value": "https://www.virustotal.com/file/278daf9d3ec640505af292b30e4b176f1b9a82a3784d29b6c1f627038455cd88/analysis/1363586129/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275967-d194-445a-9f50-4d7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:03.000Z",
|
|
"modified": "2016-05-02T13:43:03.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 05e79fe215b04d78f1008960f10be60d",
|
|
"pattern": "[file:hashes.SHA256 = 'f663f785c6b337e8ddc32a8703d467b4d3557be5a3f61361a0eb4edc6bb580b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275968-bed8-4670-87fa-48d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:04.000Z",
|
|
"modified": "2016-05-02T13:43:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 05e79fe215b04d78f1008960f10be60d",
|
|
"pattern": "[file:hashes.SHA1 = '7eada8a31b7e117845daeab40b68659a1f7eb2e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275968-f200-48ea-9091-401102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:04.000Z",
|
|
"modified": "2016-05-02T13:43:04.000Z",
|
|
"first_observed": "2016-05-02T13:43:04Z",
|
|
"last_observed": "2016-05-02T13:43:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275968-f200-48ea-9091-401102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275968-f200-48ea-9091-401102de0b81",
|
|
"value": "https://www.virustotal.com/file/f663f785c6b337e8ddc32a8703d467b4d3557be5a3f61361a0eb4edc6bb580b9/analysis/1402670433/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275968-d4c4-413b-a4e2-455202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:04.000Z",
|
|
"modified": "2016-05-02T13:43:04.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 038bd4efdecd4381c2b51ac101816747",
|
|
"pattern": "[file:hashes.SHA256 = 'b2b8f01c2d5ca73c3cc99c7e30acabef52b93b79675c38d7fe5c1a040ccac563']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275969-accc-458e-b02e-437702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:05.000Z",
|
|
"modified": "2016-05-02T13:43:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 038bd4efdecd4381c2b51ac101816747",
|
|
"pattern": "[file:hashes.SHA1 = '1c7f936933264e88b37bc0ac9027080f625c8bb6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--57275969-7318-4ba1-9984-4d2702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:05.000Z",
|
|
"modified": "2016-05-02T13:43:05.000Z",
|
|
"first_observed": "2016-05-02T13:43:05Z",
|
|
"last_observed": "2016-05-02T13:43:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--57275969-7318-4ba1-9984-4d2702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--57275969-7318-4ba1-9984-4d2702de0b81",
|
|
"value": "https://www.virustotal.com/file/b2b8f01c2d5ca73c3cc99c7e30acabef52b93b79675c38d7fe5c1a040ccac563/analysis/1390621061/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--57275969-cc30-4304-ad36-456d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:05.000Z",
|
|
"modified": "2016-05-02T13:43:05.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0213afd3721928daa1fd4192c9edaf16",
|
|
"pattern": "[file:hashes.SHA256 = '24b53b78d4ff8bcb8f0e0f00d10fcfb20e66843e7606d3f04609a2f7e5f3e673']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596a-d4cc-4796-8fac-4acb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:06.000Z",
|
|
"modified": "2016-05-02T13:43:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 0213afd3721928daa1fd4192c9edaf16",
|
|
"pattern": "[file:hashes.SHA1 = '9fbab71a0a9cd40cdb76f67f746fbe419d4e4d1e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727596a-b0f4-4f6b-bc94-496202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:06.000Z",
|
|
"modified": "2016-05-02T13:43:06.000Z",
|
|
"first_observed": "2016-05-02T13:43:06Z",
|
|
"last_observed": "2016-05-02T13:43:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727596a-b0f4-4f6b-bc94-496202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727596a-b0f4-4f6b-bc94-496202de0b81",
|
|
"value": "https://www.virustotal.com/file/24b53b78d4ff8bcb8f0e0f00d10fcfb20e66843e7606d3f04609a2f7e5f3e673/analysis/1446794439/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596a-bc64-465a-a4a3-43d602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:06.000Z",
|
|
"modified": "2016-05-02T13:43:06.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 01cc9c914ece9d6c88b4a2c7fb7ec24e",
|
|
"pattern": "[file:hashes.SHA256 = 'b2140f3bdd57f01cf809b0556edc95b1db508a0ccc5a4edaac0b783aaedd6733']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596b-16a0-4a5f-abaf-4e9d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:07.000Z",
|
|
"modified": "2016-05-02T13:43:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 01cc9c914ece9d6c88b4a2c7fb7ec24e",
|
|
"pattern": "[file:hashes.SHA1 = '1143b7f30786e016f12455121986fbf2642f1300']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727596b-e2a4-4550-901b-4fce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:07.000Z",
|
|
"modified": "2016-05-02T13:43:07.000Z",
|
|
"first_observed": "2016-05-02T13:43:07Z",
|
|
"last_observed": "2016-05-02T13:43:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727596b-e2a4-4550-901b-4fce02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727596b-e2a4-4550-901b-4fce02de0b81",
|
|
"value": "https://www.virustotal.com/file/b2140f3bdd57f01cf809b0556edc95b1db508a0ccc5a4edaac0b783aaedd6733/analysis/1361550837/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596b-5870-4063-80d9-4b5a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:07.000Z",
|
|
"modified": "2016-05-02T13:43:07.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 008a6d9e67f18a2ad1f4bb10a354a8be",
|
|
"pattern": "[file:hashes.SHA256 = 'e985c562bc89e479a48836fe290c9570106fd23739f90b74070eae67dc4a66a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596c-272c-4fb0-b1cc-44b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:08.000Z",
|
|
"modified": "2016-05-02T13:43:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 008a6d9e67f18a2ad1f4bb10a354a8be",
|
|
"pattern": "[file:hashes.SHA1 = '5b6a277b0296a345b8f6d2a7f1a9bfb8b5b523e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727596c-0fd8-45b6-b173-4fd002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:08.000Z",
|
|
"modified": "2016-05-02T13:43:08.000Z",
|
|
"first_observed": "2016-05-02T13:43:08Z",
|
|
"last_observed": "2016-05-02T13:43:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727596c-0fd8-45b6-b173-4fd002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727596c-0fd8-45b6-b173-4fd002de0b81",
|
|
"value": "https://www.virustotal.com/file/e985c562bc89e479a48836fe290c9570106fd23739f90b74070eae67dc4a66a3/analysis/1403689807/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596c-ea38-463e-88c0-475d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:08.000Z",
|
|
"modified": "2016-05-02T13:43:08.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 005b33c20c8d89453f6f0858b41881f2",
|
|
"pattern": "[file:hashes.SHA256 = '3034eaa8e6cc10184089ace14fd4735838d34f41b4a466c3cde84f0dc5adab11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5727596d-fb20-41cf-8b76-49c702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:09.000Z",
|
|
"modified": "2016-05-02T13:43:09.000Z",
|
|
"description": "Observed Hashes - Xchecked via VT: 005b33c20c8d89453f6f0858b41881f2",
|
|
"pattern": "[file:hashes.SHA1 = '48961e648ca7f116971433eaf99638c45c47f3ba']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-05-02T13:43:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5727596d-6c90-4255-9f46-4bef02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:43:09.000Z",
|
|
"modified": "2016-05-02T13:43:09.000Z",
|
|
"first_observed": "2016-05-02T13:43:09Z",
|
|
"last_observed": "2016-05-02T13:43:09Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5727596d-6c90-4255-9f46-4bef02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5727596d-6c90-4255-9f46-4bef02de0b81",
|
|
"value": "https://www.virustotal.com/file/3034eaa8e6cc10184089ace14fd4735838d34f41b4a466c3cde84f0dc5adab11/analysis/1361303817/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--57275b70-70f4-4c03-8283-6245950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-05-02T13:51:44.000Z",
|
|
"modified": "2016-05-02T13:51:44.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "Attack campaigns that have very limited scope often remain hidden for years. If only a few malware samples are deployed, it\u00e2\u20ac\u2122s less likely that security industry researchers will identify and connect them together.\r\nIn May 2015, Palo Alto Networks WildFire detected two e-mails carrying malicious documents from a genuine and compromised Israeli Gmail account, sent to an Israeli industrial organization. One e-mail carried a Microsoft PowerPoint file named \u00e2\u20ac\u0153thanks.pps\u00e2\u20ac\u009d (VirusTotal), the other a Microsoft Word document named \u00e2\u20ac\u0153request.docx\u00e2\u20ac\u009d.\r\nAround the same time, WildFire also captured an e-mail containing a Word document (\u00e2\u20ac\u0153hello.docx\u00e2\u20ac\u009d) with an identical hash as the earlier Word document, this time sent to a U.S. Government recipient.\r\nBased on various attributes of these files and the functionality of the malware they install, we have identified and collected over 40 variants of a previously unpublished malware family we call Infy, which has been involved in attacks stretching back to 2007. Attacks using this tool were still active as of April 2016."
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |