adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5bfc6891-b838-44fe-bc17-16b702de0b81.json

339 lines
No EOL
15 KiB
JSON
Raw Permalink Blame History

{
"type": "bundle",
"id": "bundle--5bfc6891-b838-44fe-bc17-16b702de0b81",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T22:13:14.000Z",
"modified": "2018-11-26T22:13:14.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5bfc6891-b838-44fe-bc17-16b702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T22:13:14.000Z",
"modified": "2018-11-26T22:13:14.000Z",
"name": "OSINT - `event-stream` dependency attack steals wallets from users of copay",
"published": "2018-11-26T22:13:22Z",
"object_refs": [
"observed-data--5bfc68a3-19e0-4f70-81d4-48d502de0b81",
"url--5bfc68a3-19e0-4f70-81d4-48d502de0b81",
"indicator--5bfc68be-0b50-47a2-a33e-16c502de0b81",
"indicator--5bfc68bf-51a0-4f93-84ff-16c502de0b81",
"indicator--5bfc68bf-4798-421d-b09f-16c502de0b81",
"indicator--5bfc68c0-af3c-4165-8243-16c502de0b81",
"x-misp-attribute--5bfc68ef-2698-4780-b1f5-45c902de0b81",
"observed-data--5bfc691b-da14-4228-997c-40e802de0b81",
"user-account--5bfc691b-da14-4228-997c-40e802de0b81",
"observed-data--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81",
"url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81",
"observed-data--5bfc697d-ab8c-4a6b-9083-453702de0b81",
"url--5bfc697d-ab8c-4a6b-9083-453702de0b81",
"observed-data--5bfc6990-28ec-4517-a397-4b8502de0b81",
"url--5bfc6990-28ec-4517-a397-4b8502de0b81",
"observed-data--5bfc69b5-bd34-40c5-a2da-42e202de0b81",
"url--5bfc69b5-bd34-40c5-a2da-42e202de0b81",
"x-misp-attribute--5bfc69de-2090-455c-8b3c-45b102de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"ecsirt:intrusions=\"application-compromise\"",
"estimative-language:confidence-in-analytic-judgment=\"high\"",
"estimative-language:likelihood-probability=\"almost-certain\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc68a3-19e0-4f70-81d4-48d502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:41:55.000Z",
"modified": "2018-11-26T21:41:55.000Z",
"first_observed": "2018-11-26T21:41:55Z",
"last_observed": "2018-11-26T21:41:55Z",
"number_observed": 1,
"object_refs": [
"url--5bfc68a3-19e0-4f70-81d4-48d502de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bfc68a3-19e0-4f70-81d4-48d502de0b81",
"value": "https://github.com/bitpay/copay/issues/9346#issuecomment-441749542"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bfc68be-0b50-47a2-a33e-16c502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:42:22.000Z",
"modified": "2018-11-26T21:42:22.000Z",
"description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"",
"pattern": "[domain-name:value = 'copayapi.host']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-26T21:42:22Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bfc68bf-51a0-4f93-84ff-16c502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:42:23.000Z",
"modified": "2018-11-26T21:42:23.000Z",
"description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.38.112.212']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-26T21:42:23Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bfc68bf-4798-421d-b09f-16c502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:42:23.000Z",
"modified": "2018-11-26T21:42:23.000Z",
"description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '145.249.104.239']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-26T21:42:23Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bfc68c0-af3c-4165-8243-16c502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:42:24.000Z",
"modified": "2018-11-26T21:42:24.000Z",
"description": "\"HTTP POST traffic on port 8080 to copayapi.host (which currently resolves to 51.38.112.212 and previously resolved to 145.249.104.239) or 111.90.151.134 indicates compromised and exfiltrated wallet private keys.\"",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '111.90.151.134']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-26T21:42:24Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5bfc68ef-2698-4780-b1f5-45c902de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:47:26.000Z",
"modified": "2018-11-26T21:47:26.000Z",
"labels": [
"misp:type=\"dns-soa-email\"",
"misp:category=\"Attribution\"",
"misp:to_ids=\"True\""
],
"x_misp_category": "Attribution",
"x_misp_comment": "copayapi.host's SOA record indicates the domain registrant's email address is \"kvlguuvh@sharklasers.co\" (very likely a throwaway email address).",
"x_misp_type": "dns-soa-email",
"x_misp_value": "kvlguuvh@sharklasers.co"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc691b-da14-4228-997c-40e802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:43:55.000Z",
"modified": "2018-11-26T21:43:55.000Z",
"first_observed": "2018-11-26T21:43:55Z",
"last_observed": "2018-11-26T21:43:55Z",
"number_observed": 1,
"object_refs": [
"user-account--5bfc691b-da14-4228-997c-40e802de0b81"
],
"labels": [
"misp:type=\"github-username\"",
"misp:category=\"Social network\""
]
},
{
"type": "user-account",
"spec_version": "2.1",
"id": "user-account--5bfc691b-da14-4228-997c-40e802de0b81",
"account_login": "right9ctrl",
"account_type": "github"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:45:14.000Z",
"modified": "2018-11-26T21:45:14.000Z",
"first_observed": "2018-11-26T21:45:14Z",
"last_observed": "2018-11-26T21:45:14Z",
"number_observed": 1,
"object_refs": [
"url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81"
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bfc696a-2a8c-4e1d-9f1c-4ef902de0b81",
"value": "https://www.npmjs.com/~right9ctrl"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc697d-ab8c-4a6b-9083-453702de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:45:33.000Z",
"modified": "2018-11-26T21:45:33.000Z",
"first_observed": "2018-11-26T21:45:33Z",
"last_observed": "2018-11-26T21:45:33Z",
"number_observed": 1,
"object_refs": [
"url--5bfc697d-ab8c-4a6b-9083-453702de0b81"
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bfc697d-ab8c-4a6b-9083-453702de0b81",
"value": "https://github.com/hugeglass/flatmap-stream"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc6990-28ec-4517-a397-4b8502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:45:52.000Z",
"modified": "2018-11-26T21:45:52.000Z",
"first_observed": "2018-11-26T21:45:52Z",
"last_observed": "2018-11-26T21:45:52Z",
"number_observed": 1,
"object_refs": [
"url--5bfc6990-28ec-4517-a397-4b8502de0b81"
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bfc6990-28ec-4517-a397-4b8502de0b81",
"value": "https://www.npmjs.com/~hugeglass"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bfc69b5-bd34-40c5-a2da-42e202de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:46:29.000Z",
"modified": "2018-11-26T21:46:29.000Z",
"first_observed": "2018-11-26T21:46:29Z",
"last_observed": "2018-11-26T21:46:29Z",
"number_observed": 1,
"object_refs": [
"url--5bfc69b5-bd34-40c5-a2da-42e202de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bfc69b5-bd34-40c5-a2da-42e202de0b81",
"value": "https://github.com/dominictarr/event-stream/issues/116"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5bfc69de-2090-455c-8b3c-45b102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-26T21:47:10.000Z",
"modified": "2018-11-26T21:47:10.000Z",
"labels": [
"misp:type=\"whois-registrant-email\"",
"misp:category=\"Attribution\""
],
"x_misp_category": "Attribution",
"x_misp_type": "whois-registrant-email",
"x_misp_value": "right9ctrl@outlook.com"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink