884 lines
No EOL
37 KiB
JSON
884 lines
No EOL
37 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--56af46bd-e4d0-4bf8-aa4a-4228950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:13.000Z",
|
|
"modified": "2016-02-01T15:04:13.000Z",
|
|
"name": "CthulhuSPRL.be",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--56af46bd-e4d0-4bf8-aa4a-4228950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:13.000Z",
|
|
"modified": "2016-02-01T15:04:13.000Z",
|
|
"name": "OSINT Threat Actors Use Sketchy Dating Website to Launch New Home Router Attacks by Damballa",
|
|
"published": "2016-02-01T11:57:35Z",
|
|
"object_refs": [
|
|
"observed-data--56af46e3-bdb4-465e-af63-4caf950d210f",
|
|
"url--56af46e3-bdb4-465e-af63-4caf950d210f",
|
|
"indicator--56af46ff-c5b8-49c1-8fc1-4148950d210f",
|
|
"indicator--56af470d-7d54-4c2a-a1f7-4956950d210f",
|
|
"indicator--56af4763-1e2c-4323-8edd-4841950d210f",
|
|
"indicator--56af4763-3fe4-4cdb-ac7d-4301950d210f",
|
|
"indicator--56af4763-0568-4df5-9e3c-4da1950d210f",
|
|
"indicator--56af4764-0764-4ba6-bbe9-4b93950d210f",
|
|
"x-misp-attribute--56af479a-41d4-4775-bb13-46fa950d210f",
|
|
"indicator--56af47ff-5b08-42bf-98af-4312950d210f",
|
|
"indicator--56af47ff-a02c-493a-be12-40b3950d210f",
|
|
"indicator--56af47ff-c0bc-43aa-8408-41d8950d210f",
|
|
"indicator--56af4800-58ec-4b70-bd88-417d950d210f",
|
|
"indicator--56af4800-c3b8-4287-8d93-4e87950d210f",
|
|
"indicator--56af4800-91ac-4bd5-b7c5-4b49950d210f",
|
|
"indicator--56af4801-5fbc-42f2-b045-4276950d210f",
|
|
"indicator--56af481a-d628-41a1-994d-4d5b950d210f",
|
|
"indicator--56af73ee-88bc-466b-9a0c-450c02de0b81",
|
|
"indicator--56af73ee-afc0-46a9-b817-4d0d02de0b81",
|
|
"observed-data--56af73ee-2a38-4a8e-b1c4-460802de0b81",
|
|
"url--56af73ee-2a38-4a8e-b1c4-460802de0b81",
|
|
"indicator--56af73ee-2628-4579-8d87-424902de0b81",
|
|
"indicator--56af73ef-9200-469e-ba8b-4d6202de0b81",
|
|
"observed-data--56af73ef-9d38-47c6-80ee-498902de0b81",
|
|
"url--56af73ef-9d38-47c6-80ee-498902de0b81",
|
|
"indicator--56af73ef-95e0-4e21-894c-4b6a02de0b81",
|
|
"indicator--56af73ef-4ac4-4873-b518-4ba402de0b81",
|
|
"observed-data--56af73f0-9bf0-4865-a5c9-484402de0b81",
|
|
"url--56af73f0-9bf0-4865-a5c9-484402de0b81",
|
|
"indicator--56af73f0-91e8-4af7-bcc8-4cc002de0b81",
|
|
"indicator--56af73f0-e09c-4b96-8611-464602de0b81",
|
|
"observed-data--56af73f0-cb58-4238-9992-40f202de0b81",
|
|
"url--56af73f0-cb58-4238-9992-40f202de0b81",
|
|
"indicator--56af73f1-15e4-47b3-adb7-413402de0b81",
|
|
"indicator--56af73f1-d60c-4da3-81dc-400a02de0b81",
|
|
"observed-data--56af73f1-b738-4032-b703-414202de0b81",
|
|
"url--56af73f1-b738-4032-b703-414202de0b81",
|
|
"indicator--56af73f1-2400-4eac-847e-495702de0b81",
|
|
"indicator--56af73f2-0e8c-40a6-9355-478802de0b81",
|
|
"observed-data--56af73f2-a6ec-41a8-94ca-4ade02de0b81",
|
|
"url--56af73f2-a6ec-41a8-94ca-4ade02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af46e3-bdb4-465e-af63-4caf950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:52:03.000Z",
|
|
"modified": "2016-02-01T11:52:03.000Z",
|
|
"first_observed": "2016-02-01T11:52:03Z",
|
|
"last_observed": "2016-02-01T11:52:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af46e3-bdb4-465e-af63-4caf950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af46e3-bdb4-465e-af63-4caf950d210f",
|
|
"value": "https://www.damballa.com/threat-actors-use-sketchy-dating-website-to-launch-new-home-router-attacks/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af46ff-c5b8-49c1-8fc1-4148950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:52:31.000Z",
|
|
"modified": "2016-02-01T11:52:31.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.103.48.34']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:52:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af470d-7d54-4c2a-a1f7-4956950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:52:45.000Z",
|
|
"modified": "2016-02-01T11:52:45.000Z",
|
|
"pattern": "[domain-name:value = 'sexyworldtouralliance.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:52:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4763-1e2c-4323-8edd-4841950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:54:11.000Z",
|
|
"modified": "2016-02-01T11:54:11.000Z",
|
|
"description": "Domains registered with same IP",
|
|
"pattern": "[domain-name:value = 'allinceofsexuality.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:54:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4763-3fe4-4cdb-ac7d-4301950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:54:11.000Z",
|
|
"modified": "2016-02-01T11:54:11.000Z",
|
|
"description": "Domains registered with same IP",
|
|
"pattern": "[domain-name:value = 'anniversaryaliancesex.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:54:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4763-0568-4df5-9e3c-4da1950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:54:11.000Z",
|
|
"modified": "2016-02-01T11:54:11.000Z",
|
|
"description": "Domains registered with same IP",
|
|
"pattern": "[domain-name:value = 'superadultnat.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:54:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4764-0764-4ba6-bbe9-4b93950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:54:12.000Z",
|
|
"modified": "2016-02-01T11:54:12.000Z",
|
|
"description": "Domains registered with same IP",
|
|
"pattern": "[domain-name:value = 'violationcyberatack.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:54:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--56af479a-41d4-4775-bb13-46fa950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:55:06.000Z",
|
|
"modified": "2016-02-01T11:55:06.000Z",
|
|
"labels": [
|
|
"misp:type=\"whois-registrant-email\"",
|
|
"misp:category=\"Attribution\""
|
|
],
|
|
"x_misp_category": "Attribution",
|
|
"x_misp_type": "whois-registrant-email",
|
|
"x_misp_value": "gordon_polo@yahoo.com"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af47ff-5b08-42bf-98af-4312950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:47.000Z",
|
|
"modified": "2016-02-01T11:56:47.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2b82c715c2f1480b57e59bd7c55ef32db312e008']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af47ff-a02c-493a-be12-40b3950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:47.000Z",
|
|
"modified": "2016-02-01T11:56:47.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'c05bd53f91032f2c8cae509477d760537f014621']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af47ff-c0bc-43aa-8408-41d8950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:47.000Z",
|
|
"modified": "2016-02-01T11:56:47.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '9b22373e8cd7c6b087ca62d1b154faa04d684549']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4800-58ec-4b70-bd88-417d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:48.000Z",
|
|
"modified": "2016-02-01T11:56:48.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '7f168f8f17774feb5f3fe35d39c41564645afa24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4800-c3b8-4287-8d93-4e87950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:48.000Z",
|
|
"modified": "2016-02-01T11:56:48.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '92632bd26fb2828ddf5a86687c837ca734d0fbbf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4800-91ac-4bd5-b7c5-4b49950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:48.000Z",
|
|
"modified": "2016-02-01T11:56:48.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '9e61bb2da5e3b9760d992d052d824ffdd584e2ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af4801-5fbc-42f2-b045-4276950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:56:49.000Z",
|
|
"modified": "2016-02-01T11:56:49.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'ea24cded99b27ff44d2ed2688dea93e3ca0214c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:56:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af481a-d628-41a1-994d-4d5b950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T11:57:14.000Z",
|
|
"modified": "2016-02-01T11:57:14.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.103.49.34']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T11:57:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ee-88bc-466b-9a0c-450c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:14.000Z",
|
|
"modified": "2016-02-01T15:04:14.000Z",
|
|
"description": "- Xchecked via VT: 9e61bb2da5e3b9760d992d052d824ffdd584e2ff",
|
|
"pattern": "[file:hashes.SHA256 = 'c6a8c74711b1c6d38b7bb7b35772b80347f80cf16296e6439d21c877474ac2e6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ee-afc0-46a9-b817-4d0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:14.000Z",
|
|
"modified": "2016-02-01T15:04:14.000Z",
|
|
"description": "- Xchecked via VT: 9e61bb2da5e3b9760d992d052d824ffdd584e2ff",
|
|
"pattern": "[file:hashes.MD5 = 'ec7378a79eb9ffd88098932a505f53cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73ee-2a38-4a8e-b1c4-460802de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:14.000Z",
|
|
"modified": "2016-02-01T15:04:14.000Z",
|
|
"first_observed": "2016-02-01T15:04:14Z",
|
|
"last_observed": "2016-02-01T15:04:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73ee-2a38-4a8e-b1c4-460802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73ee-2a38-4a8e-b1c4-460802de0b81",
|
|
"value": "https://www.virustotal.com/file/c6a8c74711b1c6d38b7bb7b35772b80347f80cf16296e6439d21c877474ac2e6/analysis/1453383429/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ee-2628-4579-8d87-424902de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:14.000Z",
|
|
"modified": "2016-02-01T15:04:14.000Z",
|
|
"description": "- Xchecked via VT: 92632bd26fb2828ddf5a86687c837ca734d0fbbf",
|
|
"pattern": "[file:hashes.SHA256 = 'a42786bec02b889675fdca7ebcc533dbc5f8d93609b6cf110d965b75dd22c971']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ef-9200-469e-ba8b-4d6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:15.000Z",
|
|
"modified": "2016-02-01T15:04:15.000Z",
|
|
"description": "- Xchecked via VT: 92632bd26fb2828ddf5a86687c837ca734d0fbbf",
|
|
"pattern": "[file:hashes.MD5 = 'd5c96a4f2e1e146a12f140f22b700333']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73ef-9d38-47c6-80ee-498902de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:15.000Z",
|
|
"modified": "2016-02-01T15:04:15.000Z",
|
|
"first_observed": "2016-02-01T15:04:15Z",
|
|
"last_observed": "2016-02-01T15:04:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73ef-9d38-47c6-80ee-498902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73ef-9d38-47c6-80ee-498902de0b81",
|
|
"value": "https://www.virustotal.com/file/a42786bec02b889675fdca7ebcc533dbc5f8d93609b6cf110d965b75dd22c971/analysis/1454058592/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ef-95e0-4e21-894c-4b6a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:15.000Z",
|
|
"modified": "2016-02-01T15:04:15.000Z",
|
|
"description": "- Xchecked via VT: 7f168f8f17774feb5f3fe35d39c41564645afa24",
|
|
"pattern": "[file:hashes.SHA256 = '794d07497f5b96efeb9428ac0fecd755878eaf906da6ffce14e940055fa7f17c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73ef-4ac4-4873-b518-4ba402de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:15.000Z",
|
|
"modified": "2016-02-01T15:04:15.000Z",
|
|
"description": "- Xchecked via VT: 7f168f8f17774feb5f3fe35d39c41564645afa24",
|
|
"pattern": "[file:hashes.MD5 = '7b8b829fd94f2a070543cc2c6bfc4040']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73f0-9bf0-4865-a5c9-484402de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:16.000Z",
|
|
"modified": "2016-02-01T15:04:16.000Z",
|
|
"first_observed": "2016-02-01T15:04:16Z",
|
|
"last_observed": "2016-02-01T15:04:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73f0-9bf0-4865-a5c9-484402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73f0-9bf0-4865-a5c9-484402de0b81",
|
|
"value": "https://www.virustotal.com/file/794d07497f5b96efeb9428ac0fecd755878eaf906da6ffce14e940055fa7f17c/analysis/1453383400/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f0-91e8-4af7-bcc8-4cc002de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:16.000Z",
|
|
"modified": "2016-02-01T15:04:16.000Z",
|
|
"description": "- Xchecked via VT: 9b22373e8cd7c6b087ca62d1b154faa04d684549",
|
|
"pattern": "[file:hashes.SHA256 = 'fdb4fc6c833353ea0202fd751900f3ac498db5209e8ca2b8de8f8bfca1fe1fdd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f0-e09c-4b96-8611-464602de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:16.000Z",
|
|
"modified": "2016-02-01T15:04:16.000Z",
|
|
"description": "- Xchecked via VT: 9b22373e8cd7c6b087ca62d1b154faa04d684549",
|
|
"pattern": "[file:hashes.MD5 = 'bbf1327c1a5213b41a4d22c4b4806f7c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73f0-cb58-4238-9992-40f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:16.000Z",
|
|
"modified": "2016-02-01T15:04:16.000Z",
|
|
"first_observed": "2016-02-01T15:04:16Z",
|
|
"last_observed": "2016-02-01T15:04:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73f0-cb58-4238-9992-40f202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73f0-cb58-4238-9992-40f202de0b81",
|
|
"value": "https://www.virustotal.com/file/fdb4fc6c833353ea0202fd751900f3ac498db5209e8ca2b8de8f8bfca1fe1fdd/analysis/1453383386/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f1-15e4-47b3-adb7-413402de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:17.000Z",
|
|
"modified": "2016-02-01T15:04:17.000Z",
|
|
"description": "- Xchecked via VT: c05bd53f91032f2c8cae509477d760537f014621",
|
|
"pattern": "[file:hashes.SHA256 = 'f12b086eaf3a190e7882167638bfc418b438d0e95b846dc2c3c1e7a092b1596e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f1-d60c-4da3-81dc-400a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:17.000Z",
|
|
"modified": "2016-02-01T15:04:17.000Z",
|
|
"description": "- Xchecked via VT: c05bd53f91032f2c8cae509477d760537f014621",
|
|
"pattern": "[file:hashes.MD5 = '514b7da4b811da11fe7033aea155dba6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73f1-b738-4032-b703-414202de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:17.000Z",
|
|
"modified": "2016-02-01T15:04:17.000Z",
|
|
"first_observed": "2016-02-01T15:04:17Z",
|
|
"last_observed": "2016-02-01T15:04:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73f1-b738-4032-b703-414202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73f1-b738-4032-b703-414202de0b81",
|
|
"value": "https://www.virustotal.com/file/f12b086eaf3a190e7882167638bfc418b438d0e95b846dc2c3c1e7a092b1596e/analysis/1454330041/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f1-2400-4eac-847e-495702de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:17.000Z",
|
|
"modified": "2016-02-01T15:04:17.000Z",
|
|
"description": "- Xchecked via VT: 2b82c715c2f1480b57e59bd7c55ef32db312e008",
|
|
"pattern": "[file:hashes.SHA256 = 'cf1bbcaf1e6902c09da35ffe6f9b93081575e7e6e2e4754684f88eb7bb8ec478']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56af73f2-0e8c-40a6-9355-478802de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:18.000Z",
|
|
"modified": "2016-02-01T15:04:18.000Z",
|
|
"description": "- Xchecked via VT: 2b82c715c2f1480b57e59bd7c55ef32db312e008",
|
|
"pattern": "[file:hashes.MD5 = 'c44f2d8ad37c18ea84a99db584d6992d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-01T15:04:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--56af73f2-a6ec-41a8-94ca-4ade02de0b81",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-01T15:04:18.000Z",
|
|
"modified": "2016-02-01T15:04:18.000Z",
|
|
"first_observed": "2016-02-01T15:04:18Z",
|
|
"last_observed": "2016-02-01T15:04:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--56af73f2-a6ec-41a8-94ca-4ade02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--56af73f2-a6ec-41a8-94ca-4ade02de0b81",
|
|
"value": "https://www.virustotal.com/file/cf1bbcaf1e6902c09da35ffe6f9b93081575e7e6e2e4754684f88eb7bb8ec478/analysis/1453894645/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |