adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/570b4c28-7480-4be0-b858-493e950d210f.json

455 lines
No EOL
20 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--570b4c28-7480-4be0-b858-493e950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:10:59.000Z",
"modified": "2016-04-11T07:10:59.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--570b4c28-7480-4be0-b858-493e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:10:59.000Z",
"modified": "2016-04-11T07:10:59.000Z",
"name": "OSINT - Locky Ransomware Domains \u00e2\u20ac\u201c Followup Analysis Uncovers 130 New Indicators",
"published": "2016-04-11T07:11:28Z",
"object_refs": [
"observed-data--570b4c72-59b8-46a3-8795-45b0950d210f",
"url--570b4c72-59b8-46a3-8795-45b0950d210f",
"x-misp-attribute--570b4c84-3afc-4f93-8d8a-4fe2950d210f",
"indicator--570b4cac-07e4-452c-8c2c-44a7950d210f",
"indicator--570b4cac-2a78-4076-8b86-4f46950d210f",
"indicator--570b4cad-d0c4-40e5-9716-49cb950d210f",
"observed-data--570b4cc2-3078-49ce-8bfb-4686950d210f",
"domain-name--570b4cc2-3078-49ce-8bfb-4686950d210f",
"indicator--570b4ce8-2980-4400-b3ec-4008950d210f",
"indicator--570b4ce9-861c-4d68-9d5e-49ca950d210f",
"indicator--570b4ce9-5480-4e10-9c56-4dbf950d210f",
"indicator--570b4ce9-6918-45eb-bc39-46ae950d210f",
"indicator--570b4cea-84e8-4817-8ba1-495b950d210f",
"indicator--570b4cea-5110-4c7d-854c-47b4950d210f",
"indicator--570b4ceb-3598-43ee-9a7a-4ca4950d210f",
"indicator--570b4ceb-c1a4-44b0-bdf5-474f950d210f",
"indicator--570b4ceb-3374-437a-be7c-48b5950d210f",
"indicator--570b4cec-8550-4c2f-91f4-4958950d210f",
"x-misp-attribute--570b4e03-dcb4-43f5-947f-41c3950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--570b4c72-59b8-46a3-8795-45b0950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:04:18.000Z",
"modified": "2016-04-11T07:04:18.000Z",
"first_observed": "2016-04-11T07:04:18Z",
"last_observed": "2016-04-11T07:04:18Z",
"number_observed": 1,
"object_refs": [
"url--570b4c72-59b8-46a3-8795-45b0950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--570b4c72-59b8-46a3-8795-45b0950d210f",
"value": "https://blog.threatstop.com/2016/04/08/locky-ransomware-domains-followup-research/"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--570b4c84-3afc-4f93-8d8a-4fe2950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:04:36.000Z",
"modified": "2016-04-11T07:04:36.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Recently, there has been a lot of buzz over a flourishing ransomware that goes by the name of Locky, which encrypts a victim\u00e2\u20ac\u2122s data using a strong RSA-2048+AES-128 encryption and then demands between 0.5-2 bitcoins for the decryption of that data.\r\n\r\nThe ransomware debuted in early 2016 and is currently being distributed in various ways, including spam emails that contain Word and Excel documents with malicious macros, as well as JS scripts. Locky is also delivered via popular Exploit Kits such as Nuclear and Neutrino.\r\n\r\nLocky has widespread reach, having been used to attack victims in over 100 countries. During its first days of activity, it managed to deploy 100,000 infection attempts per day. Just recently, the ransomware was used in an attack on a Kentucky hospital, which caused them to declare an \u00e2\u20ac\u0153Internal State of Emergency.\u00e2\u20ac\u009d\r\n\r\nThe ThreatSTOP Research Team has been monitoring new Indicators of Compromise for this ransomware since its debut, and has analyzed hundreds of relevant indicators. During our analysis on these indicators, we noticed four outstanding domains\u00e2\u20ac\u201clegitimate-looking domains with the addition of the string \u00e2\u20ac\u0153qq\u00e2\u20ac\u009d or \u00e2\u20ac\u0153ff\u00e2\u20ac\u009d at the end of the domain name. These domains sparked a follow up analysis that led to amazing results."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cac-07e4-452c-8c2c-44a7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:05:16.000Z",
"modified": "2016-04-11T07:05:16.000Z",
"description": "The first step of the analysis was to map the IP connections between the 4 initial domains",
"pattern": "[domain-name:value = 'hellomydearqq.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:05:16Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cac-2a78-4076-8b86-4f46950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:05:16.000Z",
"modified": "2016-04-11T07:05:16.000Z",
"description": "The first step of the analysis was to map the IP connections between the 4 initial domains",
"pattern": "[domain-name:value = 'blablaworldqq.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:05:16Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cad-d0c4-40e5-9716-49cb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:05:17.000Z",
"modified": "2016-04-11T07:05:17.000Z",
"description": "The first step of the analysis was to map the IP connections between the 4 initial domains",
"pattern": "[domain-name:value = 'hellomisterbiznesqq.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:05:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--570b4cc2-3078-49ce-8bfb-4686950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:05:38.000Z",
"modified": "2016-04-11T07:05:38.000Z",
"first_observed": "2016-04-11T07:05:38Z",
"last_observed": "2016-04-11T07:05:38Z",
"number_observed": 1,
"object_refs": [
"domain-name--570b4cc2-3078-49ce-8bfb-4686950d210f"
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\""
]
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--570b4cc2-3078-49ce-8bfb-4686950d210f",
"value": "greetingsjamajcaff.com"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ce8-2980-4400-b3ec-4008950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:16.000Z",
"modified": "2016-04-11T07:06:16.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '202.120.42.190']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:16Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ce9-861c-4d68-9d5e-49ca950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:17.000Z",
"modified": "2016-04-11T07:06:17.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.255.10.133']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ce9-5480-4e10-9c56-4dbf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:17.000Z",
"modified": "2016-04-11T07:06:17.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '146.148.55.44']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ce9-6918-45eb-bc39-46ae950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:17.000Z",
"modified": "2016-04-11T07:06:17.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.118.142.154']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cea-84e8-4817-8ba1-495b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:18.000Z",
"modified": "2016-04-11T07:06:18.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '51.254.226.223']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cea-5110-4c7d-854c-47b4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:18.000Z",
"modified": "2016-04-11T07:06:18.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.135.108.94']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ceb-3598-43ee-9a7a-4ca4950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:18.000Z",
"modified": "2016-04-11T07:06:18.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '173.82.74.197']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:18Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ceb-c1a4-44b0-bdf5-474f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:19.000Z",
"modified": "2016-04-11T07:06:19.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '104.239.213.7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4ceb-3374-437a-be7c-48b5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:19.000Z",
"modified": "2016-04-11T07:06:19.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.105.244.11']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:19Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--570b4cec-8550-4c2f-91f4-4958950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:06:20.000Z",
"modified": "2016-04-11T07:06:20.000Z",
"description": "Imported via the freetext import.",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '198.105.254.11']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-04-11T07:06:20Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--570b4e03-dcb4-43f5-947f-41c3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-11T07:10:59.000Z",
"modified": "2016-04-11T07:10:59.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"Other\""
],
"x_misp_category": "Other",
"x_misp_type": "comment",
"x_misp_value": "It seems they are some mixes in the indicators post about TeslaCrypt and Locky infrastructures. (Comment from CIRCL)"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink