1926 lines
No EOL
81 KiB
JSON
1926 lines
No EOL
81 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5c481c61-a718-4051-aacf-4f19950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5c481c61-a718-4051-aacf-4f19950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"name": "OSINT - DarkHydrus delivers new Trojan that can use Google Drive for C2 communications",
|
|
"published": "2019-08-23T09:36:08Z",
|
|
"object_refs": [
|
|
"x-misp-attribute--5c481e62-1938-485c-8568-4f7a950d210f",
|
|
"observed-data--5c481e72-4c40-47cf-97bf-46d6950d210f",
|
|
"url--5c481e72-4c40-47cf-97bf-46d6950d210f",
|
|
"indicator--5c48316f-f314-4da1-834a-4f6c950d210f",
|
|
"indicator--5c483170-9c94-4ebc-9686-4c7e950d210f",
|
|
"indicator--5c483170-35e0-4e23-aaf8-4098950d210f",
|
|
"indicator--5c483172-aedc-49b2-9bf1-4440950d210f",
|
|
"indicator--5c483172-81f8-4d83-a3ee-40fc950d210f",
|
|
"indicator--5c483173-587c-452a-93c5-4617950d210f",
|
|
"indicator--5c483173-f400-4801-aca2-411d950d210f",
|
|
"indicator--5c483174-a6c4-45e1-baa0-44f3950d210f",
|
|
"indicator--5c483174-7744-4ebf-9483-405a950d210f",
|
|
"indicator--5c483175-aa8c-4bae-b758-477f950d210f",
|
|
"indicator--5c48325c-9fe8-4617-b287-4f66950d210f",
|
|
"indicator--5c48325d-9d64-4b8d-bf8a-4f27950d210f",
|
|
"indicator--5c48325e-9d04-4346-8104-4cc0950d210f",
|
|
"indicator--5c48325e-0934-44e0-9ad9-477a950d210f",
|
|
"indicator--5c48325f-6798-444c-ad46-47df950d210f",
|
|
"indicator--5c48325f-858c-4e35-aacf-4cd3950d210f",
|
|
"indicator--5c483260-b464-4eac-ac1e-44b9950d210f",
|
|
"indicator--5c483260-1338-48d2-b149-4bdf950d210f",
|
|
"indicator--5c483261-6914-4112-a413-4747950d210f",
|
|
"indicator--5c483261-e880-47fe-bad3-484e950d210f",
|
|
"indicator--5c4835f3-9d18-401f-9251-4f45950d210f",
|
|
"indicator--5c4835f5-3844-4367-a71c-49f0950d210f",
|
|
"indicator--5c4835f6-13e8-4f1d-9f65-4b9f950d210f",
|
|
"indicator--5c4835f7-efb8-4192-b81f-4d0f950d210f",
|
|
"indicator--5c4835f9-2e84-4a97-a0ba-4e9d950d210f",
|
|
"indicator--5c4835fa-a824-4d63-9d1e-461d950d210f",
|
|
"indicator--5c4835fc-6794-4e1d-b444-4864950d210f",
|
|
"indicator--5c4835fd-b274-467b-be08-4a1d950d210f",
|
|
"indicator--5c4835fe-96bc-48cc-a839-47fb950d210f",
|
|
"indicator--5c483600-af84-48d6-88a0-4660950d210f",
|
|
"indicator--5c483601-9e10-4856-ac87-4d5b950d210f",
|
|
"indicator--5c483602-daa8-49b1-8dea-4474950d210f",
|
|
"indicator--5c483604-b4a0-4ec5-a6c7-4b3a950d210f",
|
|
"indicator--5c483605-8240-4688-a606-4d49950d210f",
|
|
"indicator--5c4845f0-d0d4-4afa-8147-1869950d210f",
|
|
"indicator--5c4848ea-3b90-404a-a249-0941950d210f",
|
|
"indicator--5c48363f-b894-4693-96e9-4429950d210f",
|
|
"indicator--5c483653-dc5c-4ce5-9fb4-457b950d210f",
|
|
"indicator--5c48366f-5060-4b4d-a8ee-48df950d210f",
|
|
"indicator--5c4838df-1140-4d70-9ed3-4cbd950d210f",
|
|
"indicator--5c4838f4-8218-400b-b63e-4de1950d210f",
|
|
"indicator--5c483914-2a64-4525-ac9e-454c950d210f",
|
|
"indicator--5c4841b1-2610-4eb9-8972-0941950d210f",
|
|
"indicator--5c48444e-3888-4e23-8358-0a80950d210f",
|
|
"indicator--d9d74a92-d5e9-44cf-951c-9209e089e4a9",
|
|
"x-misp-object--5c97ffbd-d966-4fd3-a37b-32ef937013b2",
|
|
"indicator--daa1f647-6100-4717-8f02-db83000e128e",
|
|
"x-misp-object--b8cf49aa-c9f6-4b8f-836e-14ef60a806d7",
|
|
"indicator--eb1071b4-d800-4cde-83f6-7a6035d85171",
|
|
"x-misp-object--114f3f73-824d-4ecd-b931-ecfa06cd315b",
|
|
"indicator--0c348258-2cce-41e4-bf8f-67555be3f925",
|
|
"x-misp-object--64a6d64f-7061-4953-9693-334ea5bea2ec",
|
|
"indicator--46c359c7-edb0-4b18-a34d-9b06ce21aad5",
|
|
"x-misp-object--a2dbe480-0cac-43dd-808e-b6a735543ea5",
|
|
"indicator--7708439c-37ac-4fce-ac9f-36a1a26a84df",
|
|
"x-misp-object--eda93bd4-a0f9-40d1-9216-3ea538389e62",
|
|
"x-misp-object--2d2efd04-087d-4dec-9b15-0466b3f048e2",
|
|
"x-misp-object--97c71d46-4c70-4a75-b908-50bf2d41983d",
|
|
"x-misp-object--17aca456-82a1-47f5-9b5f-dcf90c512882",
|
|
"x-misp-object--7ff87175-d1e6-4b91-9371-6b3e0da19395",
|
|
"x-misp-object--9e0c7cec-9ce2-4efb-a881-9b86cc097610",
|
|
"x-misp-object--6a4446ed-949a-42d5-8975-db3f4994de64",
|
|
"relationship--8d712df1-d799-486c-bcf9-915379b71ce6",
|
|
"relationship--88c48bc1-19ec-48f8-9f16-8f702dbfd001",
|
|
"relationship--522a1487-209e-42c9-b8a1-0086a43c5082",
|
|
"relationship--170d0ed9-e94e-418b-a083-aec6f7d40952",
|
|
"relationship--a7b60467-cf42-4e73-90b0-9d7804130ce6",
|
|
"relationship--4d3fe216-1dca-4ffb-9e45-0672e4bb3b07",
|
|
"relationship--d7fe567d-1c4b-4ec9-a575-bd5874130037",
|
|
"relationship--7bf32011-7c78-4c99-93eb-5d636cc0a6d1",
|
|
"relationship--6267e586-3554-4d59-83a0-8def866a0493",
|
|
"relationship--759b0d16-7f3f-4a49-bc9f-dc04f110df8b",
|
|
"relationship--9a0ef51e-4d33-468f-ad29-2ebaa48628be",
|
|
"relationship--d149bc58-5f2d-421b-81ab-5a09adf31ec8"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:mitre-intrusion-set=\"DarkHydrus - G0079\"",
|
|
"misp-galaxy:threat-actor=\"DarkHydrus\"",
|
|
"type:OSINT",
|
|
"osint:lifetime=\"perpetual\"",
|
|
"osint:certainty=\"50\"",
|
|
"ecsirt:malicious-code=\"trojan\"",
|
|
"misp-galaxy:malpedia=\"RogueRobin\"",
|
|
"misp-galaxy:mitre-malware=\"RogueRobin - S0270\"",
|
|
"workflow:todo=\"expansion\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5c481e62-1938-485c-8568-4f7a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T08:08:04.000Z",
|
|
"modified": "2019-01-23T08:08:04.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "In the summer of 2018, Unit 42 released reporting regarding activity in the Middle East surrounding a cluster of activity using similar tactics, tools, and procedures (TTPs) in which we named the adversary group DarkHydrus. This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques.\r\n\r\nSince that initial reporting, we had not observed new activity from DarkHydrus until recently, when 360TIC published a tweet and subsequent research discussing delivery documents that appeared to be attributed to DarkHydrus. In the process of analyzing the delivery documents, we were able to collect additional associated samples, uncover additional functionality of the payloads including the use of Google Drive API, and confirm the strong likelihood of attribution to DarkHydrus. We have notified Google of our findings."
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5c481e72-4c40-47cf-97bf-46d6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T08:08:03.000Z",
|
|
"modified": "2019-01-23T08:08:03.000Z",
|
|
"first_observed": "2019-01-23T08:08:03Z",
|
|
"last_observed": "2019-01-23T08:08:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5c481e72-4c40-47cf-97bf-46d6950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5c481e72-4c40-47cf-97bf-46d6950d210f",
|
|
"value": "https://unit42.paloaltonetworks.com/darkhydrus-delivers-new-trojan-that-can-use-google-drive-for-c2-communications/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48316f-f314-4da1-834a-4f6c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:39.000Z",
|
|
"modified": "2019-01-23T09:18:39.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'iecvlist-microsoft.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483170-9c94-4ebc-9686-4c7e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:40.000Z",
|
|
"modified": "2019-01-23T09:18:40.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'data-microsoft.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483170-35e0-4e23-aaf8-4098950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:40.000Z",
|
|
"modified": "2019-01-23T09:18:40.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'asimov-win-microsoft.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483172-aedc-49b2-9bf1-4440950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:42.000Z",
|
|
"modified": "2019-01-23T09:18:42.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'onecs-live.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483172-81f8-4d83-a3ee-40fc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:42.000Z",
|
|
"modified": "2019-01-23T09:18:42.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'akamaiedge.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483173-587c-452a-93c5-4617950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:43.000Z",
|
|
"modified": "2019-01-23T09:18:43.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'phicdn.world']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483173-f400-4801-aca2-411d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:43.000Z",
|
|
"modified": "2019-01-23T09:18:43.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'azureedge.today']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483174-a6c4-45e1-baa0-44f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:44.000Z",
|
|
"modified": "2019-01-23T09:18:44.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'nsatc.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483174-7744-4ebf-9483-405a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:44.000Z",
|
|
"modified": "2019-01-23T09:18:44.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 'akamai.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483175-aa8c-4bae-b758-477f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:18:45.000Z",
|
|
"modified": "2019-01-23T09:18:45.000Z",
|
|
"description": "Related Domains",
|
|
"pattern": "[domain-name:value = 't-msedge.world']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:18:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325c-9fe8-4617-b287-4f66950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:36.000Z",
|
|
"modified": "2019-01-23T09:22:36.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'tvs1.trafficmanager.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325d-9d64-4b8d-bf8a-4f27950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:37.000Z",
|
|
"modified": "2019-01-23T09:22:37.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'tvs2.trafficmanager.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325e-9d04-4346-8104-4cc0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:38.000Z",
|
|
"modified": "2019-01-23T09:22:38.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'tbs1.microsoftonline.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325e-0934-44e0-9ad9-477a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:38.000Z",
|
|
"modified": "2019-01-23T09:22:38.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'tbs2.microsoftonline.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325f-6798-444c-ad46-47df950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:39.000Z",
|
|
"modified": "2019-01-23T09:22:39.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'brit.ns.cloudfronts.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48325f-858c-4e35-aacf-4cd3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:39.000Z",
|
|
"modified": "2019-01-23T09:22:39.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'dns.cloudfronts.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483260-b464-4eac-ac1e-44b9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:40.000Z",
|
|
"modified": "2019-01-23T09:22:40.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'ns2.akadns.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483260-1338-48d2-b149-4bdf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:40.000Z",
|
|
"modified": "2019-01-23T09:22:40.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'britns.akadns.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483261-6914-4112-a413-4747950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:41.000Z",
|
|
"modified": "2019-01-23T09:22:41.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'britns.akadns.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483261-e880-47fe-bad3-484e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:22:41.000Z",
|
|
"modified": "2019-01-23T09:22:41.000Z",
|
|
"description": "Nameservers",
|
|
"pattern": "[domain-name:value = 'ns2.akadns.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:22:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835f3-9d18-401f-9251-4f45950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:37:55.000Z",
|
|
"modified": "2019-01-23T09:37:55.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'akdns.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:37:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835f5-3844-4367-a71c-49f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:37:57.000Z",
|
|
"modified": "2019-01-23T09:37:57.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'akamaiedge.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:37:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835f6-13e8-4f1d-9f65-4b9f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:37:58.000Z",
|
|
"modified": "2019-01-23T09:37:58.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'edgekey.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:37:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835f7-efb8-4192-b81f-4d0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:37:59.000Z",
|
|
"modified": "2019-01-23T09:37:59.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'akamaized.live']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:37:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835f9-2e84-4a97-a0ba-4e9d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:01.000Z",
|
|
"modified": "2019-01-23T09:38:01.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = '0ffice365.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835fa-a824-4d63-9d1e-461d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:02.000Z",
|
|
"modified": "2019-01-23T09:38:02.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = '0nedrive.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835fc-6794-4e1d-b444-4864950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:04.000Z",
|
|
"modified": "2019-01-23T09:38:04.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'corewindows.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835fd-b274-467b-be08-4a1d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:05.000Z",
|
|
"modified": "2019-01-23T09:38:05.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'microsoftonline.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4835fe-96bc-48cc-a839-47fb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:06.000Z",
|
|
"modified": "2019-01-23T09:38:06.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'onedrive.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483600-af84-48d6-88a0-4660950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:08.000Z",
|
|
"modified": "2019-01-23T09:38:08.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'sharepoint.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483601-9e10-4856-ac87-4d5b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:09.000Z",
|
|
"modified": "2019-01-23T09:38:09.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'skydrive.agency']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483602-daa8-49b1-8dea-4474950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:10.000Z",
|
|
"modified": "2019-01-23T09:38:10.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = '0ffice365.life']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483604-b4a0-4ec5-a6c7-4b3a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:12.000Z",
|
|
"modified": "2019-01-23T09:38:12.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = '0ffice365.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483605-8240-4688-a606-4d49950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:38:13.000Z",
|
|
"modified": "2019-01-23T09:38:13.000Z",
|
|
"description": "RogueRobin C2s",
|
|
"pattern": "[domain-name:value = 'skydrive.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:38:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4845f0-d0d4-4afa-8147-1869950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T10:46:08.000Z",
|
|
"modified": "2019-01-23T10:46:08.000Z",
|
|
"pattern": "[domain-name:value = '676f6f646c75636b.gogle.co']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T10:46:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4848ea-3b90-404a-a249-0941950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T10:58:50.000Z",
|
|
"modified": "2019-01-23T10:58:50.000Z",
|
|
"pattern": "[url:value = 'tbs1/tbs2.microsoftonline.services']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T10:58:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48363f-b894-4693-96e9-4429950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:39:11.000Z",
|
|
"modified": "2019-01-23T09:39:11.000Z",
|
|
"description": "RogueRobin",
|
|
"pattern": "[file:hashes.SHA256 = 'eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:39:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483653-dc5c-4ce5-9fb4-457b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:39:31.000Z",
|
|
"modified": "2019-01-23T09:39:31.000Z",
|
|
"description": "RogueRobin",
|
|
"pattern": "[file:hashes.SHA256 = 'f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:39:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48366f-5060-4b4d-a8ee-48df950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:39:59.000Z",
|
|
"modified": "2019-01-23T09:39:59.000Z",
|
|
"description": "RogueRobin",
|
|
"pattern": "[file:hashes.SHA256 = '5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:39:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4838df-1140-4d70-9ed3-4cbd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:50:23.000Z",
|
|
"modified": "2019-01-23T09:50:23.000Z",
|
|
"description": "Delivery Document",
|
|
"pattern": "[file:hashes.SHA256 = '513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:50:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4838f4-8218-400b-b63e-4de1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:50:44.000Z",
|
|
"modified": "2019-01-23T09:50:44.000Z",
|
|
"description": "Delivery Document",
|
|
"pattern": "[file:hashes.SHA256 = 'e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:50:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c483914-2a64-4525-ac9e-454c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T09:51:16.000Z",
|
|
"modified": "2019-01-23T09:51:16.000Z",
|
|
"description": "Delivery Document",
|
|
"pattern": "[file:hashes.SHA256 = '4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T09:51:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c4841b1-2610-4eb9-8972-0941950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T10:28:01.000Z",
|
|
"modified": "2019-01-23T10:28:01.000Z",
|
|
"pattern": "[file:name = '12-B-366.txt' AND file:parent_directory_ref.path = '\\\\%TEMP\\\\%' AND file:x_misp_state = 'Malicious' AND file:x_misp_fullpath = '\\\\%TEMP\\\\%\\\\12-B-366.txt']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T10:28:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c48444e-3888-4e23-8358-0a80950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-01-23T10:39:10.000Z",
|
|
"modified": "2019-01-23T10:39:10.000Z",
|
|
"pattern": "[file:name = 'WindowsTemplate.exe' AND file:parent_directory_ref.path = '\\\\%APPDATA\\\\%\\\\Microsoft\\\\Windows\\\\Templates\\\\' AND file:x_misp_state = 'Malicious' AND file:x_misp_fullpath = '\\\\%APPDATA\\\\%\\\\Microsoft\\\\Windows\\\\Templates\\\\WindowsTemplate.exe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-01-23T10:39:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d9d74a92-d5e9-44cf-951c-9209e089e4a9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:04.000Z",
|
|
"modified": "2019-08-23T09:36:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = '8dc9f5450402ae799f5f8afd5c0a8352' AND file:hashes.SHA1 = '58ea259ea8231175140f03993d57b91b67465bf0' AND file:hashes.SHA256 = 'e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5c97ffbd-d966-4fd3-a37b-32ef937013b2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:09.000Z",
|
|
"modified": "2019-07-19T09:23:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-03-27T13:49:58",
|
|
"category": "Other",
|
|
"uuid": "cc65fe50-4173-4c03-bd6f-c38d960f8f84"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022/analysis/1553694598/",
|
|
"category": "Payload delivery",
|
|
"uuid": "bd3e1921-525a-4355-8079-580e19772ebc"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "41/62",
|
|
"category": "Payload delivery",
|
|
"uuid": "d2c8ac9a-094d-4b87-b546-ff424b2d88c2"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--daa1f647-6100-4717-8f02-db83000e128e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:04.000Z",
|
|
"modified": "2019-08-23T09:36:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = '5c3f96ade0ea67eef9d25161c64e6f3e' AND file:hashes.SHA1 = '524f2c9f62703027b1ebbf1fc16a4a7506d6ff20' AND file:hashes.SHA256 = '513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b8cf49aa-c9f6-4b8f-836e-14ef60a806d7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:09.000Z",
|
|
"modified": "2019-07-19T09:23:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-06-04T23:57:46",
|
|
"category": "Other",
|
|
"uuid": "ac8ba530-cefe-4a6d-ab7c-2acd514ae349"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8/analysis/1559692666/",
|
|
"category": "Payload delivery",
|
|
"uuid": "0e8ac8eb-6bee-45cf-a90c-83403a8f84f5"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "45/62",
|
|
"category": "Payload delivery",
|
|
"uuid": "c99901fc-603a-47be-ad92-25b8e49afdb1"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--eb1071b4-d800-4cde-83f6-7a6035d85171",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:04.000Z",
|
|
"modified": "2019-08-23T09:36:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = '039bd47f0fdb6bb7d68a2428c71f317d' AND file:hashes.SHA1 = '1d73611c6d77a07de90199864c6341d58657db43' AND file:hashes.SHA256 = 'f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--114f3f73-824d-4ecd-b931-ecfa06cd315b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:10.000Z",
|
|
"modified": "2019-07-19T09:23:10.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-30T00:54:00",
|
|
"category": "Other",
|
|
"uuid": "290047a1-8f60-4237-9499-25930aafaf87"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0/analysis/1556585640/",
|
|
"category": "Payload delivery",
|
|
"uuid": "ae08342d-d69b-4806-8f9a-23456e8988b7"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/72",
|
|
"category": "Payload delivery",
|
|
"uuid": "9c359b30-75e6-4541-b307-6580f7f8ca8a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--0c348258-2cce-41e4-bf8f-67555be3f925",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:04.000Z",
|
|
"modified": "2019-08-23T09:36:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'c3b1bd4e3e159591d84e77452a09851d' AND file:hashes.SHA1 = '0fece8a649e88635c35222fbc8ce49d6ef2e77c1' AND file:hashes.SHA256 = '5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--64a6d64f-7061-4953-9693-334ea5bea2ec",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:10.000Z",
|
|
"modified": "2019-07-19T09:23:10.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-06-25T16:23:56",
|
|
"category": "Other",
|
|
"uuid": "365e0979-45c2-48ff-b067-8427c971a484"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c/analysis/1561479836/",
|
|
"category": "Payload delivery",
|
|
"uuid": "cca113a9-1a86-4416-9965-6a8147c59c98"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "56/72",
|
|
"category": "Payload delivery",
|
|
"uuid": "6e5fbe1c-0986-44d0-b675-60639a24dc26"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--46c359c7-edb0-4b18-a34d-9b06ce21aad5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:05.000Z",
|
|
"modified": "2019-08-23T09:36:05.000Z",
|
|
"pattern": "[file:hashes.MD5 = '89e50d52e498c34f1e976cf9a1017a39' AND file:hashes.SHA1 = '1b8fe1d2194e685c0cce2f00c33e7f069f3a4d54' AND file:hashes.SHA256 = '4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a2dbe480-0cac-43dd-808e-b6a735543ea5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:11.000Z",
|
|
"modified": "2019-07-19T09:23:11.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-06-06T23:48:31",
|
|
"category": "Other",
|
|
"uuid": "2b56458b-80ca-4d60-abbe-7133142c0cd0"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8/analysis/1559864911/",
|
|
"category": "Payload delivery",
|
|
"uuid": "a8b28daa-01c7-4049-a0ec-9da443fbe78e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "44/62",
|
|
"category": "Payload delivery",
|
|
"uuid": "9489327d-b04a-4b82-86c6-4cb0fbd1fc19"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7708439c-37ac-4fce-ac9f-36a1a26a84df",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:05.000Z",
|
|
"modified": "2019-08-23T09:36:05.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'b108412f1cdc0602d82d3e6b318dc634' AND file:hashes.SHA1 = '0681f2abe5c6d7e80afe27b8aba08abac43c39d8' AND file:hashes.SHA256 = 'eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-08-23T09:36:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--eda93bd4-a0f9-40d1-9216-3ea538389e62",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-07-19T09:23:11.000Z",
|
|
"modified": "2019-07-19T09:23:11.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-07-09T02:11:15",
|
|
"category": "Other",
|
|
"uuid": "1de46e79-770f-4323-9920-92bcd8e6158f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97/analysis/1562638275/",
|
|
"category": "Payload delivery",
|
|
"uuid": "2f0ff0fb-59af-4c85-a29f-74e0d9800836"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "53/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "ff7e98c4-e38f-4559-82cf-f51c124c34f5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2d2efd04-087d-4dec-9b15-0466b3f048e2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:05.000Z",
|
|
"modified": "2019-08-23T09:36:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-03-27T13:49:58",
|
|
"category": "Other",
|
|
"uuid": "a14c6c4d-58f8-44f9-98a7-11ce52b45ad4"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022/analysis/1553694598/",
|
|
"category": "Payload delivery",
|
|
"uuid": "91031c7d-821b-4a78-9f41-991e362b0c21"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "41/62",
|
|
"category": "Payload delivery",
|
|
"uuid": "94c21631-20b1-47cb-b6bc-1abccd4c2297"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--97c71d46-4c70-4a75-b908-50bf2d41983d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:05.000Z",
|
|
"modified": "2019-08-23T09:36:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-30T00:54:00",
|
|
"category": "Other",
|
|
"uuid": "07d3c689-845e-4b8e-b450-f1641896f608"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0/analysis/1556585640/",
|
|
"category": "Payload delivery",
|
|
"uuid": "67e32e8b-6fb6-49f4-af4a-7f8aa958cf8d"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/72",
|
|
"category": "Payload delivery",
|
|
"uuid": "3e4563f0-98ab-4d5a-9df1-9070de5e14ff"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--17aca456-82a1-47f5-9b5f-dcf90c512882",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:06.000Z",
|
|
"modified": "2019-08-23T09:36:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-08-19T23:33:04",
|
|
"category": "Other",
|
|
"uuid": "a5633be9-d191-4586-bfcc-f257ef119285"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8/analysis/1566257584/",
|
|
"category": "Payload delivery",
|
|
"uuid": "c4c400c7-e486-4e6d-afcb-d925083cd18c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "42/58",
|
|
"category": "Payload delivery",
|
|
"uuid": "d397fd9c-03ea-4acf-bdb5-3db0dc518e8b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--7ff87175-d1e6-4b91-9371-6b3e0da19395",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:06.000Z",
|
|
"modified": "2019-08-23T09:36:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-08-19T23:36:42",
|
|
"category": "Other",
|
|
"uuid": "c816cc5c-d424-4486-a978-ea0bee21b276"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c/analysis/1566257802/",
|
|
"category": "Payload delivery",
|
|
"uuid": "9d02a0a8-944e-4573-99a3-f3055339dadf"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/66",
|
|
"category": "Payload delivery",
|
|
"uuid": "6939b75d-20a9-4b70-9b30-e54671f34750"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9e0c7cec-9ce2-4efb-a881-9b86cc097610",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:06.000Z",
|
|
"modified": "2019-08-23T09:36:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-08-22T23:42:21",
|
|
"category": "Other",
|
|
"uuid": "77f9cbd1-61e7-40c4-a680-813aa29103b5"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97/analysis/1566517341/",
|
|
"category": "Payload delivery",
|
|
"uuid": "d0d353b6-0be4-4210-877b-b037b7176a29"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "52/66",
|
|
"category": "Payload delivery",
|
|
"uuid": "7eefc615-e3fc-40dd-b723-78f71492885b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--6a4446ed-949a-42d5-8975-db3f4994de64",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-08-23T09:36:06.000Z",
|
|
"modified": "2019-08-23T09:36:06.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-08-22T23:34:02",
|
|
"category": "Other",
|
|
"uuid": "01e94ff0-197f-41d2-b036-84dfd9a3ecd0"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8/analysis/1566516842/",
|
|
"category": "Payload delivery",
|
|
"uuid": "68d380af-15c6-4ecb-9ded-89093bec151b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "40/55",
|
|
"category": "Payload delivery",
|
|
"uuid": "4dec3344-b3e0-45ae-b019-caaacf098c69"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8d712df1-d799-486c-bcf9-915379b71ce6",
|
|
"created": "2019-07-19T09:23:11.000Z",
|
|
"modified": "2019-07-19T09:23:11.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--d9d74a92-d5e9-44cf-951c-9209e089e4a9",
|
|
"target_ref": "x-misp-object--5c97ffbd-d966-4fd3-a37b-32ef937013b2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--88c48bc1-19ec-48f8-9f16-8f702dbfd001",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--d9d74a92-d5e9-44cf-951c-9209e089e4a9",
|
|
"target_ref": "x-misp-object--2d2efd04-087d-4dec-9b15-0466b3f048e2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--522a1487-209e-42c9-b8a1-0086a43c5082",
|
|
"created": "2019-07-19T09:23:12.000Z",
|
|
"modified": "2019-07-19T09:23:12.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--daa1f647-6100-4717-8f02-db83000e128e",
|
|
"target_ref": "x-misp-object--b8cf49aa-c9f6-4b8f-836e-14ef60a806d7"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--170d0ed9-e94e-418b-a083-aec6f7d40952",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--daa1f647-6100-4717-8f02-db83000e128e",
|
|
"target_ref": "x-misp-object--6a4446ed-949a-42d5-8975-db3f4994de64"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a7b60467-cf42-4e73-90b0-9d7804130ce6",
|
|
"created": "2019-07-19T09:23:13.000Z",
|
|
"modified": "2019-07-19T09:23:13.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--eb1071b4-d800-4cde-83f6-7a6035d85171",
|
|
"target_ref": "x-misp-object--114f3f73-824d-4ecd-b931-ecfa06cd315b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4d3fe216-1dca-4ffb-9e45-0672e4bb3b07",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--eb1071b4-d800-4cde-83f6-7a6035d85171",
|
|
"target_ref": "x-misp-object--97c71d46-4c70-4a75-b908-50bf2d41983d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d7fe567d-1c4b-4ec9-a575-bd5874130037",
|
|
"created": "2019-07-19T09:23:13.000Z",
|
|
"modified": "2019-07-19T09:23:13.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--0c348258-2cce-41e4-bf8f-67555be3f925",
|
|
"target_ref": "x-misp-object--64a6d64f-7061-4953-9693-334ea5bea2ec"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7bf32011-7c78-4c99-93eb-5d636cc0a6d1",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--0c348258-2cce-41e4-bf8f-67555be3f925",
|
|
"target_ref": "x-misp-object--7ff87175-d1e6-4b91-9371-6b3e0da19395"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6267e586-3554-4d59-83a0-8def866a0493",
|
|
"created": "2019-07-19T09:23:13.000Z",
|
|
"modified": "2019-07-19T09:23:13.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--46c359c7-edb0-4b18-a34d-9b06ce21aad5",
|
|
"target_ref": "x-misp-object--a2dbe480-0cac-43dd-808e-b6a735543ea5"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--759b0d16-7f3f-4a49-bc9f-dc04f110df8b",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--46c359c7-edb0-4b18-a34d-9b06ce21aad5",
|
|
"target_ref": "x-misp-object--17aca456-82a1-47f5-9b5f-dcf90c512882"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9a0ef51e-4d33-468f-ad29-2ebaa48628be",
|
|
"created": "2019-07-19T09:23:13.000Z",
|
|
"modified": "2019-07-19T09:23:13.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--7708439c-37ac-4fce-ac9f-36a1a26a84df",
|
|
"target_ref": "x-misp-object--eda93bd4-a0f9-40d1-9216-3ea538389e62"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d149bc58-5f2d-421b-81ab-5a09adf31ec8",
|
|
"created": "2019-08-23T09:36:07.000Z",
|
|
"modified": "2019-08-23T09:36:07.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--7708439c-37ac-4fce-ac9f-36a1a26a84df",
|
|
"target_ref": "x-misp-object--9e0c7cec-9ce2-4efb-a881-9b86cc097610"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |