1300 lines
No EOL
52 KiB
JSON
1300 lines
No EOL
52 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5a044f70-28a8-45a4-b350-cdab950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:26:02.000Z",
|
|
"modified": "2017-11-09T20:26:02.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "grouping",
|
|
"spec_version": "2.1",
|
|
"id": "grouping--5a044f70-28a8-45a4-b350-cdab950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:26:02.000Z",
|
|
"modified": "2017-11-09T20:26:02.000Z",
|
|
"name": "M2M - Locky Affid=3, \".asasin\" 2017-11-02 : \"12_Invoice_3456\" - \"001_1234.doc\"",
|
|
"context": "suspicious-activity",
|
|
"object_refs": [
|
|
"indicator--5a044f71-4498-467c-ab71-48ff950d210f",
|
|
"indicator--5a044f72-27b4-401e-89b0-4ab9950d210f",
|
|
"indicator--5a044f72-adcc-4152-89f8-4ee9950d210f",
|
|
"observed-data--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"network-traffic--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"ipv4-addr--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"indicator--5a044f72-a9c8-4ddd-b446-991b950d210f",
|
|
"indicator--5a044f73-d3b8-4499-9158-cdb1950d210f",
|
|
"observed-data--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"network-traffic--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"ipv4-addr--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"indicator--5a044f73-3948-40c5-a2f7-cc6f950d210f",
|
|
"indicator--5a044f73-8444-4c98-9302-48f9950d210f",
|
|
"observed-data--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"network-traffic--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"ipv4-addr--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"indicator--5a044f74-fa18-495a-87e8-20a6950d210f",
|
|
"indicator--5a044f74-5734-481a-a7dc-cd35950d210f",
|
|
"observed-data--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"network-traffic--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"ipv4-addr--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"indicator--5a044f75-9a44-415e-88a7-cda3950d210f",
|
|
"indicator--5a044f75-6c00-4ebc-8fae-991b950d210f",
|
|
"observed-data--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"network-traffic--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"ipv4-addr--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"indicator--5a044f75-bdc4-4877-9069-cdab950d210f",
|
|
"indicator--5a044f76-61a4-4bfe-8e0d-2214950d210f",
|
|
"observed-data--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"network-traffic--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"ipv4-addr--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"indicator--5a044f76-ae48-41f2-a4bb-4d84950d210f",
|
|
"indicator--5a044f76-ae04-44b9-8a3f-4eda950d210f",
|
|
"observed-data--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"network-traffic--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"ipv4-addr--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"indicator--5a044f7a-e1b4-40c9-9c18-75a9950d210f",
|
|
"indicator--5a044f7b-aa14-4c53-b56d-20a6950d210f",
|
|
"observed-data--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"network-traffic--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"ipv4-addr--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"indicator--5a044f7b-bd48-43f4-a5d7-991b950d210f",
|
|
"indicator--5a044f7b-cdf8-4123-8992-48ec950d210f",
|
|
"observed-data--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"network-traffic--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"ipv4-addr--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"indicator--5a044f7c-0f38-4603-b7d5-cc6f950d210f",
|
|
"indicator--5a044f7c-5c74-4e31-8738-47c6950d210f",
|
|
"observed-data--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"network-traffic--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"ipv4-addr--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"indicator--5a044f7d-32d8-47f3-85f2-4a7e950d210f",
|
|
"indicator--5a044f7d-b21c-48e5-b462-cda3950d210f",
|
|
"observed-data--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"network-traffic--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"ipv4-addr--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"indicator--5a044f7d-afbc-47a0-ab66-4d24950d210f",
|
|
"indicator--5a044f7e-353c-48dd-b43d-4d17950d210f",
|
|
"observed-data--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"network-traffic--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"ipv4-addr--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"indicator--5a044f7e-ce38-414d-ba71-2214950d210f",
|
|
"indicator--5a044f7f-9d74-49e7-86c0-4337950d210f",
|
|
"observed-data--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"network-traffic--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"ipv4-addr--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"indicator--5a044f7f-9e20-4642-a4a9-cd35950d210f",
|
|
"indicator--5a044f80-34c4-4182-a96e-717b950d210f",
|
|
"indicator--5a04b9d4-6098-4af4-a972-4c9702de0b81",
|
|
"indicator--5a04b9d4-f76c-43c8-a7b5-48a102de0b81",
|
|
"observed-data--5a04b9d4-17ac-4410-b44a-494d02de0b81",
|
|
"url--5a04b9d4-17ac-4410-b44a-494d02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f71-4498-467c-ab71-48ff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[file:hashes.MD5 = '26671a0b08b87754a72ab3d0c2256059']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f72-27b4-401e-89b0-4ab9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://nozovent.net/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f72-adcc-4152-89f8-4ee9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[domain-name:value = 'nozovent.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"first_observed": "2017-11-09T20:25:55Z",
|
|
"last_observed": "2017-11-09T20:25:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"ipv4-addr--5a044f72-e3ac-4b5d-978a-cda3950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f72-e3ac-4b5d-978a-cda3950d210f",
|
|
"value": "167.114.138.110"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f72-a9c8-4ddd-b446-991b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://pccreatief.nl/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f73-d3b8-4499-9158-cdb1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[domain-name:value = 'pccreatief.nl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"first_observed": "2017-11-09T20:25:55Z",
|
|
"last_observed": "2017-11-09T20:25:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"ipv4-addr--5a044f73-cba0-4e88-89e8-cdab950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f73-cba0-4e88-89e8-cdab950d210f",
|
|
"value": "85.25.192.252"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f73-3948-40c5-a2f7-cc6f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://plaissetty.com/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f73-8444-4c98-9302-48f9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[domain-name:value = 'plaissetty.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"first_observed": "2017-11-09T20:25:55Z",
|
|
"last_observed": "2017-11-09T20:25:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"ipv4-addr--5a044f74-fcac-4eff-aed4-4414950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f74-fcac-4eff-aed4-4414950d210f",
|
|
"value": "91.121.183.59"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f74-fa18-495a-87e8-20a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://ro.isuzu.it/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f74-5734-481a-a7dc-cd35950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[domain-name:value = 'ro.isuzu.it']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"first_observed": "2017-11-09T20:25:55Z",
|
|
"last_observed": "2017-11-09T20:25:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"ipv4-addr--5a044f74-5c24-4898-9219-4ac3950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f74-5c24-4898-9219-4ac3950d210f",
|
|
"value": "95.110.189.247"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f75-9a44-415e-88a7-cda3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://sirbis.de/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f75-6c00-4ebc-8fae-991b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[domain-name:value = 'sirbis.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"first_observed": "2017-11-09T20:25:55Z",
|
|
"last_observed": "2017-11-09T20:25:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"ipv4-addr--5a044f75-c740-4f76-9b4a-cdb1950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f75-c740-4f76-9b4a-cdb1950d210f",
|
|
"value": "46.163.72.181"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f75-bdc4-4877-9069-cdab950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:55.000Z",
|
|
"modified": "2017-11-09T20:25:55.000Z",
|
|
"pattern": "[url:value = 'http://skivvies.com/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f76-61a4-4bfe-8e0d-2214950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'skivvies.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"ipv4-addr--5a044f76-f550-4ea7-8437-462c950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f76-f550-4ea7-8437-462c950d210f",
|
|
"value": "204.197.241.45"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f76-ae48-41f2-a4bb-4d84950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://studio311.de/Jmdnaf36dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f76-ae04-44b9-8a3f-4eda950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'studio311.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"ipv4-addr--5a044f77-d234-4fb1-8bd4-75a9950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f77-d234-4fb1-8bd4-75a9950d210f",
|
|
"value": "217.182.199.8"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7a-e1b4-40c9-9c18-75a9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://michelsmarkt.de/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7b-aa14-4c53-b56d-20a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'michelsmarkt.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"ipv4-addr--5a044f7b-29a0-41dc-96a4-42b9950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7b-29a0-41dc-96a4-42b9950d210f",
|
|
"value": "173.212.228.135"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7b-bd48-43f4-a5d7-991b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://noya-en.eu/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7b-cdf8-4123-8992-48ec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'noya-en.eu']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"ipv4-addr--5a044f7c-d3a0-42a4-9f91-cdb1950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7c-d3a0-42a4-9f91-cdb1950d210f",
|
|
"value": "185.66.251.178"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7c-0f38-4603-b7d5-cc6f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://ruemmelin.info/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7c-5c74-4e31-8738-47c6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'ruemmelin.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"ipv4-addr--5a044f7d-b22c-432a-a43e-75a9950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7d-b22c-432a-a43e-75a9950d210f",
|
|
"value": "81.90.33.38"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7d-32d8-47f3-85f2-4a7e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://remers-messebau.de/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7d-b21c-48e5-b462-cda3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'remers-messebau.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"ipv4-addr--5a044f7d-731c-4c6d-a6d2-991b950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7d-731c-4c6d-a6d2-991b950d210f",
|
|
"value": "89.163.140.72"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7d-afbc-47a0-ab66-4d24950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://ollyandfriends.de/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7e-353c-48dd-b43d-4d17950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'ollyandfriends.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"ipv4-addr--5a044f7e-ad0c-4742-93e8-cdab950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7e-ad0c-4742-93e8-cdab950d210f",
|
|
"value": "85.119.155.42"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7e-ce38-414d-ba71-2214950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://primeassociatesinc.com/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7f-9d74-49e7-86c0-4337950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'primeassociatesinc.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"ipv4-addr--5a044f7f-d44c-48dd-ab0f-498f950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"dst_ref": "ipv4-addr--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5a044f7f-d44c-48dd-ab0f-498f950d210f",
|
|
"value": "209.54.51.32"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f7f-9e20-4642-a4a9-cd35950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[url:value = 'http://verwadirephen.info/p66/Jgsn5srs']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a044f80-34c4-4182-a96e-717b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"pattern": "[domain-name:value = 'verwadirephen.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a04b9d4-6098-4af4-a972-4c9702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"description": "- Xchecked via VT: 26671a0b08b87754a72ab3d0c2256059",
|
|
"pattern": "[file:hashes.SHA256 = '68d73a56515a94be6400ea2ea625d256f439e3b279576dcdcb07948929e1d1cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a04b9d4-f76c-43c8-a7b5-48a102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"description": "- Xchecked via VT: 26671a0b08b87754a72ab3d0c2256059",
|
|
"pattern": "[file:hashes.SHA1 = '491178c82dee6e81030bd880ec3647c93b307e01']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-11-09T20:25:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a04b9d4-17ac-4410-b44a-494d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-11-09T20:25:56.000Z",
|
|
"modified": "2017-11-09T20:25:56.000Z",
|
|
"first_observed": "2017-11-09T20:25:56Z",
|
|
"last_observed": "2017-11-09T20:25:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5a04b9d4-17ac-4410-b44a-494d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5a04b9d4-17ac-4410-b44a-494d02de0b81",
|
|
"value": "https://www.virustotal.com/file/68d73a56515a94be6400ea2ea625d256f439e3b279576dcdcb07948929e1d1cd/analysis/1510096080/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |