905 lines
No EOL
39 KiB
JSON
905 lines
No EOL
39 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5a26b513-1ffc-497b-8cac-c53a950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:07:39.000Z",
|
|
"modified": "2018-10-26T09:07:39.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5a26b513-1ffc-497b-8cac-c53a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:07:39.000Z",
|
|
"modified": "2018-10-26T09:07:39.000Z",
|
|
"name": "OSINT - Multi-stage malware sneaks into Google Play",
|
|
"published": "2018-10-26T09:07:52Z",
|
|
"object_refs": [
|
|
"observed-data--5a26b520-8974-4557-9ecb-4260950d210f",
|
|
"url--5a26b520-8974-4557-9ecb-4260950d210f",
|
|
"indicator--5a2e4c0c-e20c-4386-bdc9-c566950d210f",
|
|
"indicator--5a2e4c0c-5e7c-446d-979f-c566950d210f",
|
|
"indicator--5a2e4c0d-6ec0-4617-b698-c566950d210f",
|
|
"indicator--5a2e4c0d-0d90-4608-b0e4-c566950d210f",
|
|
"indicator--5a2e4c0e-ae14-4d56-81da-c566950d210f",
|
|
"x-misp-attribute--5a2e4c7f-9ce8-418d-ae08-b401950d210f",
|
|
"indicator--5a2e4046-8b60-456b-8b75-5467950d210f",
|
|
"indicator--5a2e4265-81d0-44f3-ba7c-5daf950d210f",
|
|
"indicator--5a2e42c6-1420-41e4-8580-60de950d210f",
|
|
"indicator--5a2e4302-df2c-4db4-8bba-71d3950d210f",
|
|
"indicator--5a2e46e8-f488-40cd-a9ec-878d950d210f",
|
|
"indicator--5a2e499b-4ccc-4e5c-ae67-bb07950d210f",
|
|
"indicator--5a2e4a5b-b27c-4c2f-9112-ba38950d210f",
|
|
"indicator--5a2e4a97-e268-44ea-ada6-bbe1950d210f",
|
|
"indicator--11c074b2-9ef5-468f-9a71-70ea7abb9d67",
|
|
"x-misp-object--df8032d7-cbe9-49fd-9747-63d74730df9f",
|
|
"indicator--475d3bb8-eb86-4c51-a3a3-15ab39d91ddf",
|
|
"x-misp-object--94031eb7-4ff3-486e-b44f-eb4fa2ab0c1c",
|
|
"indicator--90b018c5-f3af-4ebf-9bb9-452b205d3038",
|
|
"x-misp-object--caa22be8-c2c9-465f-8aaa-c20e3eafec9f",
|
|
"indicator--a62c5ce0-9e21-466e-b317-a0a00fef80ef",
|
|
"x-misp-object--1263f071-0c4b-4d90-b6ef-81682679e425",
|
|
"indicator--959b41df-ba0f-4520-a633-f28b0d7e5b21",
|
|
"x-misp-object--9c3a68e0-2e10-46ad-adda-0237549ebcd1",
|
|
"indicator--973efe60-da30-4d60-aa15-6a1ee7f82e22",
|
|
"x-misp-object--6b985af4-f961-4f8d-b2f7-513b6ed1c140",
|
|
"indicator--ae8d1770-da33-4160-92e5-bc56fe5781d5",
|
|
"x-misp-object--095999e8-cf65-4068-9aa8-111b4596ae64",
|
|
"indicator--01689a22-9fef-4b84-bc15-84a951d19e66",
|
|
"x-misp-object--2f933552-e105-4559-9ba2-4adb53dde71b"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT",
|
|
"circl:incident-classification=\"malware\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a26b520-8974-4557-9ecb-4260950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-05T15:03:03.000Z",
|
|
"modified": "2017-12-05T15:03:03.000Z",
|
|
"first_observed": "2017-12-05T15:03:03Z",
|
|
"last_observed": "2017-12-05T15:03:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5a26b520-8974-4557-9ecb-4260950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5a26b520-8974-4557-9ecb-4260950d210f",
|
|
"value": "https://www.welivesecurity.com/2017/11/15/multi-stage-malware-sneaks-google-play/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4c0c-e20c-4386-bdc9-c566950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:12:44.000Z",
|
|
"modified": "2017-12-11T09:12:44.000Z",
|
|
"description": "Hardcoded domains hosting links to the third-stage payloads",
|
|
"pattern": "[domain-name:value = 'loaderclientarea24.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:12:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4c0c-5e7c-446d-979f-c566950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:12:44.000Z",
|
|
"modified": "2017-12-11T09:12:44.000Z",
|
|
"description": "Hardcoded domains hosting links to the third-stage payloads",
|
|
"pattern": "[domain-name:value = 'loaderclientarea22.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:12:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4c0d-6ec0-4617-b698-c566950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:12:45.000Z",
|
|
"modified": "2017-12-11T09:12:45.000Z",
|
|
"description": "Hardcoded domains hosting links to the third-stage payloads",
|
|
"pattern": "[domain-name:value = 'loaderclientarea20.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:12:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4c0d-0d90-4608-b0e4-c566950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:12:45.000Z",
|
|
"modified": "2017-12-11T09:12:45.000Z",
|
|
"description": "Hardcoded domains hosting links to the third-stage payloads",
|
|
"pattern": "[domain-name:value = 'loaderclientarea15.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:12:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4c0e-ae14-4d56-81da-c566950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:12:46.000Z",
|
|
"modified": "2017-12-11T09:12:46.000Z",
|
|
"description": "Hardcoded domains hosting links to the third-stage payloads",
|
|
"pattern": "[domain-name:value = 'loaderclientarea13.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:12:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5a2e4c7f-9ce8-418d-ae08-b401950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:14:49.000Z",
|
|
"modified": "2017-12-11T09:14:49.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "Anti-detection features\r\n\r\nThese malware samples all employ a multi-stage architecture and encryption to stay under the radar.\r\n\r\nAfter being downloaded and installed, these apps do not request any suspicious permissions and even mimic the activity the user expects them to exhibit.\r\n\r\nAlong with this, the malicious app also decrypts and executes its payload \u00e2\u20ac\u201c that is, the first-stage payload. This payload decrypts and executes the second-stage payload, which is stored in the assets of the initial app downloaded from Google Play. These steps are invisible to the user and serve as obfuscatory measures."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4046-8b60-456b-8b75-5467950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T08:22:30.000Z",
|
|
"modified": "2017-12-11T08:22:30.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '9ab5a05bc3c8f1931a3a49278e18d2116f529704' AND file:name = 'com.fleeeishei.erabladmounsem']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T08:22:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4265-81d0-44f3-ba7c-5daf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T08:31:33.000Z",
|
|
"modified": "2017-12-11T08:31:33.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2e47c816a517548a0fbf809324d63868708d00d0' AND file:name = 'com.softmuiiurket.cleanerforandroid']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T08:31:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e42c6-1420-41e4-8580-60de950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T08:33:10.000Z",
|
|
"modified": "2017-12-11T08:33:10.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'de64139e6e91ac0dde755d2ef49d60251984652f' AND file:name = 'com.expjhvjhertsoft.bestrambooster']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T08:33:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4302-df2c-4db4-8bba-71d3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T08:34:10.000Z",
|
|
"modified": "2017-12-11T08:34:10.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '6ab844c8fd654aaec29dac095214f4430012ee0e' AND file:name = 'gotov.games.toppro']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T08:34:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e46e8-f488-40cd-a9ec-878d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T08:50:48.000Z",
|
|
"modified": "2017-12-11T08:50:48.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'c8dd6815f30367695938a7613c11e029055279a2' AND file:name = 'slots.forgame.vul']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T08:50:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e499b-4ccc-4e5c-ae67-bb07950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:02:19.000Z",
|
|
"modified": "2017-12-11T09:02:19.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '47442bfdfbc0fb350b8b30271c310fe44ffb119a' AND file:name = 'com.bucholregaum.hampelpa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:02:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4a5b-b27c-4c2f-9112-ba38950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:05:31.000Z",
|
|
"modified": "2017-12-11T09:05:31.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '604e6dcdf1fa1f7b5a85892ac3761bed81405bf6' AND file:name = 'com.peridesuramant.worldnews']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:05:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a2e4a97-e268-44ea-ada6-bbe1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-12-11T09:06:31.000Z",
|
|
"modified": "2017-12-11T09:06:31.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '532079b31e3acef2d71c75b31d77480304b2f7b9' AND file:name = 'com.peridesurrramant.worldnews']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-12-11T09:06:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--11c074b2-9ef5-468f-9a71-70ea7abb9d67",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:05:46.000Z",
|
|
"modified": "2018-10-26T09:05:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '4e6183687717cf7d7adc906cf5450729' AND file:hashes.SHA1 = 'c8dd6815f30367695938a7613c11e029055279a2' AND file:hashes.SHA256 = 'd6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:05:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--df8032d7-cbe9-49fd-9747-63d74730df9f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:05:49.000Z",
|
|
"modified": "2018-10-26T09:05:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:24:43",
|
|
"category": "Other",
|
|
"uuid": "72b61313-867c-48fe-afae-33879fda2b33"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/d6e48539252c4425bbb8f4b7e60f9ca6cbb703f324bbf1dde025a3d935b74cb9/analysis/1538688283/",
|
|
"category": "External analysis",
|
|
"uuid": "4f384fe0-2a17-4c90-81bd-1eea46dcb4dc"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "30/61",
|
|
"category": "Other",
|
|
"uuid": "2fdf0dd7-f0e3-4a27-b288-fd731165a63b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--475d3bb8-eb86-4c51-a3a3-15ab39d91ddf",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:05:50.000Z",
|
|
"modified": "2018-10-26T09:05:50.000Z",
|
|
"pattern": "[file:hashes.MD5 = '21af98ec1a99ae37367d2e71d16b85fa' AND file:hashes.SHA1 = 'de64139e6e91ac0dde755d2ef49d60251984652f' AND file:hashes.SHA256 = 'f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:05:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--94031eb7-4ff3-486e-b44f-eb4fa2ab0c1c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:05:58.000Z",
|
|
"modified": "2018-10-26T09:05:58.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:32:29",
|
|
"category": "Other",
|
|
"uuid": "beace62d-a2d6-42ad-a1ff-0d85f7ccf447"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/f0c97217377ab0b4dd71baf5529d79e6349e477e69d4043a82f9c768ef46a932/analysis/1538688749/",
|
|
"category": "External analysis",
|
|
"uuid": "f5e4dc71-0ada-47da-9c85-dd7999b9fdb4"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "30/62",
|
|
"category": "Other",
|
|
"uuid": "69190414-96bf-48ed-8a7c-2e002e4ef9eb"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--90b018c5-f3af-4ebf-9bb9-452b205d3038",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:12.000Z",
|
|
"modified": "2018-10-26T09:06:12.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'f9617beec1b56eace79e870cb0925ffd' AND file:hashes.SHA1 = '604e6dcdf1fa1f7b5a85892ac3761bed81405bf6' AND file:hashes.SHA256 = '3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:06:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--caa22be8-c2c9-465f-8aaa-c20e3eafec9f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:14.000Z",
|
|
"modified": "2018-10-26T09:06:14.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:32:21",
|
|
"category": "Other",
|
|
"uuid": "f3bd1117-6b76-40f4-b890-3ff8c3a11b3a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/3fc104c7fb8f6419aa5b45a3abfcc545ddb8e225f1b6dcaf5824075cbdf5dddd/analysis/1538688741/",
|
|
"category": "External analysis",
|
|
"uuid": "081c6e6e-4bcc-4223-9840-923e63ed044c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "30/62",
|
|
"category": "Other",
|
|
"uuid": "70e00152-a2f1-46fd-b7c7-55f38c1255a4"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a62c5ce0-9e21-466e-b317-a0a00fef80ef",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:16.000Z",
|
|
"modified": "2018-10-26T09:06:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'c4acc83183ac0fabe92fc02ae5ef3ca4' AND file:hashes.SHA1 = '9ab5a05bc3c8f1931a3a49278e18d2116f529704' AND file:hashes.SHA256 = 'dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:06:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1263f071-0c4b-4d90-b6ef-81682679e425",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:23.000Z",
|
|
"modified": "2018-10-26T09:06:23.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:32:25",
|
|
"category": "Other",
|
|
"uuid": "8aa24a31-7fdd-4ed4-a632-705aa09205d3"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/dd857e8505cedf84b316eb0f5cdcba1386fb8412bc630e671f474aeedfccb387/analysis/1538688745/",
|
|
"category": "External analysis",
|
|
"uuid": "0cc5c304-cd11-41a5-9583-7e971aad4310"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "34/62",
|
|
"category": "Other",
|
|
"uuid": "5263a8d1-50e1-4f76-8f4b-d73cef90d7ed"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--959b41df-ba0f-4520-a633-f28b0d7e5b21",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:25.000Z",
|
|
"modified": "2018-10-26T09:06:25.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a0dcd9907a3726edfb8e7de48b3aa8f6' AND file:hashes.SHA1 = '6ab844c8fd654aaec29dac095214f4430012ee0e' AND file:hashes.SHA256 = 'e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:06:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9c3a68e0-2e10-46ad-adda-0237549ebcd1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:27.000Z",
|
|
"modified": "2018-10-26T09:06:27.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:24:52",
|
|
"category": "Other",
|
|
"uuid": "fac591a5-dfe8-45be-994b-d62da1b2a50d"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e980dc97b0b63158e251e6055d0f4362bf0a105bd999146de048f13a8f4aadb7/analysis/1538688292/",
|
|
"category": "External analysis",
|
|
"uuid": "58702d62-de2f-4573-b03a-f18fd9513e2e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "29/62",
|
|
"category": "Other",
|
|
"uuid": "7a7627ca-a13a-48e8-8fad-142354ccfc99"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--973efe60-da30-4d60-aa15-6a1ee7f82e22",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:29.000Z",
|
|
"modified": "2018-10-26T09:06:29.000Z",
|
|
"pattern": "[file:hashes.MD5 = '327d37ad6391c674f2f5a96e08cbc95f' AND file:hashes.SHA1 = '47442bfdfbc0fb350b8b30271c310fe44ffb119a' AND file:hashes.SHA256 = 'ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:06:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--6b985af4-f961-4f8d-b2f7-513b6ed1c140",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:43.000Z",
|
|
"modified": "2018-10-26T09:06:43.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:32:08",
|
|
"category": "Other",
|
|
"uuid": "1b0b2e29-f922-40e2-b9e7-e1138cc8cd16"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ef3dfcd3e1351f46ee3cbfb3f71fe9d06a445d8affe2e679f34d8bf4bb618849/analysis/1538688728/",
|
|
"category": "External analysis",
|
|
"uuid": "e48a740f-3a6a-4209-b09f-9ce33ca4d094"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "31/61",
|
|
"category": "Other",
|
|
"uuid": "6184c6e0-29e2-4165-8e42-ccf5bbb23b19"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--ae8d1770-da33-4160-92e5-bc56fe5781d5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:06:57.000Z",
|
|
"modified": "2018-10-26T09:06:57.000Z",
|
|
"pattern": "[file:hashes.MD5 = '2d5b8b4a868cbb8947f869f789fef5ff' AND file:hashes.SHA1 = '532079b31e3acef2d71c75b31d77480304b2f7b9' AND file:hashes.SHA256 = 'd2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:06:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--095999e8-cf65-4068-9aa8-111b4596ae64",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:07:06.000Z",
|
|
"modified": "2018-10-26T09:07:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:32:13",
|
|
"category": "Other",
|
|
"uuid": "9f46d30d-be05-4c45-be71-9d342e9a2fa1"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/d2a6cbe9acd4193188f7aa6d922c916999845da82171889526550790f5632b47/analysis/1538688733/",
|
|
"category": "External analysis",
|
|
"uuid": "5d3c8f72-90a2-466d-82ae-de692d5e9523"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "28/60",
|
|
"category": "Other",
|
|
"uuid": "4d7c5d08-44bb-456b-8b95-19a3c5f79d4c"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--01689a22-9fef-4b84-bc15-84a951d19e66",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:07:15.000Z",
|
|
"modified": "2018-10-26T09:07:15.000Z",
|
|
"pattern": "[file:hashes.MD5 = '2ed45ea4f3b26adcc5eaa88b5234c997' AND file:hashes.SHA1 = '2e47c816a517548a0fbf809324d63868708d00d0' AND file:hashes.SHA256 = 'ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-26T09:07:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2f933552-e105-4559-9ba2-4adb53dde71b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-26T09:07:17.000Z",
|
|
"modified": "2018-10-26T09:07:17.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-10-04T21:31:07",
|
|
"category": "Other",
|
|
"uuid": "973e093c-1a25-4961-9a70-1047fb6be0e7"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ab9f1a59fcae8374282a39f244f164b58dbed4d16c37366bf2272c9509a7502e/analysis/1538688667/",
|
|
"category": "External analysis",
|
|
"uuid": "8f0d0a5f-9323-4973-b32a-adaf4007fe08"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "30/60",
|
|
"category": "Other",
|
|
"uuid": "2367705e-c040-48af-8d75-755949bfadf7"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |