adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/570669fe-4138-40e0-ba49-4990950d210f.json

298 lines
No EOL
12 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--570669fe-4138-40e0-ba49-4990950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:07:13.000Z",
"modified": "2016-04-07T15:07:13.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--570669fe-4138-40e0-ba49-4990950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:07:13.000Z",
"modified": "2016-04-07T15:07:13.000Z",
"name": "Kegotip downloader",
"published": "2016-04-07T15:15:10Z",
"object_refs": [
"indicator--57066a3d-774c-439d-8d24-37e9950d210f",
"indicator--57066a3d-e7f8-4e8b-aa04-37e9950d210f",
"indicator--57066a3e-4528-40bf-a8b0-37e9950d210f",
"indicator--57066fb9-05d4-40ff-8078-4bfe02de0b81",
"indicator--57066fb9-2e90-497d-ab82-417d02de0b81",
"observed-data--57066fba-86dc-4ad4-91e2-4d9802de0b81",
"url--57066fba-86dc-4ad4-91e2-4d9802de0b81",
"indicator--5706778f-cd40-4fed-824c-8ef7950d210f",
"indicator--570677a1-6d90-4e02-aed2-bac602de0b81",
"indicator--570677a2-7534-419b-ba03-bac602de0b81",
"observed-data--570677a2-8510-46c1-bb67-bac602de0b81",
"url--570677a2-8510-46c1-bb67-bac602de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"circl:incident-classification=\"malware\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57066a3d-774c-439d-8d24-37e9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:10:05.000Z",
"modified": "2016-04-07T14:10:05.000Z",
"description": "Imported via the freetext import.",
"pattern": "[file:hashes.MD5 = 'f563f980e99a91fe011fe331bea190d6']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T14:10:05Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57066a3d-e7f8-4e8b-aa04-37e9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:10:05.000Z",
"modified": "2016-04-07T14:10:05.000Z",
"description": "download location (down)",
"pattern": "[url:value = 'http://51.255.70.98/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T14:10:05Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57066a3e-4528-40bf-a8b0-37e9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:10:06.000Z",
"modified": "2016-04-07T14:10:06.000Z",
"description": "download location (down)",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.255.70.98']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T14:10:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57066fb9-05d4-40ff-8078-4bfe02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:33:29.000Z",
"modified": "2016-04-07T14:33:29.000Z",
"description": "Imported via the freetext import. - Xchecked via VT: f563f980e99a91fe011fe331bea190d6",
"pattern": "[file:hashes.SHA256 = '0ea08351e522eda5e3abb1b5b0cf921784b5bfd4eda31ad44ffa5d28ac76d3f7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T14:33:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57066fb9-2e90-497d-ab82-417d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:33:29.000Z",
"modified": "2016-04-07T14:33:29.000Z",
"description": "Imported via the freetext import. - Xchecked via VT: f563f980e99a91fe011fe331bea190d6",
"pattern": "[file:hashes.SHA1 = 'e26dc11326c8ec4a0399b149741f667e9219da87']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T14:33:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57066fba-86dc-4ad4-91e2-4d9802de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T14:33:30.000Z",
"modified": "2016-04-07T14:33:30.000Z",
"first_observed": "2016-04-07T14:33:30Z",
"last_observed": "2016-04-07T14:33:30Z",
"number_observed": 1,
"object_refs": [
"url--57066fba-86dc-4ad4-91e2-4d9802de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--57066fba-86dc-4ad4-91e2-4d9802de0b81",
"value": "https://www.virustotal.com/file/0ea08351e522eda5e3abb1b5b0cf921784b5bfd4eda31ad44ffa5d28ac76d3f7/analysis/1459963946/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5706778f-cd40-4fed-824c-8ef7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:06:55.000Z",
"modified": "2016-04-07T15:06:55.000Z",
"description": "Imported via the freetext import.",
"pattern": "[file:hashes.MD5 = 'd22500f4cc2abf32642a0862fd1d135d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T15:06:55Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570677a1-6d90-4e02-aed2-bac602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:07:13.000Z",
"modified": "2016-04-07T15:07:13.000Z",
"description": "Imported via the freetext import. - Xchecked via VT: d22500f4cc2abf32642a0862fd1d135d",
"pattern": "[file:hashes.SHA256 = 'e9958ef800594203e541f25a70dddf2eda71ecce7bee33c9054a79776e6a0b5d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T15:07:13Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570677a2-7534-419b-ba03-bac602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:07:14.000Z",
"modified": "2016-04-07T15:07:14.000Z",
"description": "Imported via the freetext import. - Xchecked via VT: d22500f4cc2abf32642a0862fd1d135d",
"pattern": "[file:hashes.SHA1 = 'd69e52c7949bed85fd37129809f50c8277352d47']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-07T15:07:14Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--570677a2-8510-46c1-bb67-bac602de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-07T15:07:14.000Z",
"modified": "2016-04-07T15:07:14.000Z",
"first_observed": "2016-04-07T15:07:14Z",
"last_observed": "2016-04-07T15:07:14Z",
"number_observed": 1,
"object_refs": [
"url--570677a2-8510-46c1-bb67-bac602de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--570677a2-8510-46c1-bb67-bac602de0b81",
"value": "https://www.virustotal.com/file/e9958ef800594203e541f25a70dddf2eda71ecce7bee33c9054a79776e6a0b5d/analysis/1460039225/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink