adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/57174526-23d8-4895-8c08-4ed1950d210f.json

303 lines
No EOL
13 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--57174526-23d8-4895-8c08-4ed1950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:52:14.000Z",
"modified": "2016-04-20T11:52:14.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--57174526-23d8-4895-8c08-4ed1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:52:14.000Z",
"modified": "2016-04-20T11:52:14.000Z",
"name": "New ransomware",
"published": "2016-04-20T12:03:15Z",
"object_refs": [
"observed-data--57174536-95fc-474a-bb9f-46dc950d210f",
"file--57174536-95fc-474a-bb9f-46dc950d210f",
"observed-data--57174f19-f06c-4809-92b3-476d02de0b81",
"file--57174f19-f06c-4809-92b3-476d02de0b81",
"observed-data--57174f19-c3d8-43f0-96bb-43e402de0b81",
"file--57174f19-c3d8-43f0-96bb-43e402de0b81",
"observed-data--57174f1a-a47c-458d-9900-451e02de0b81",
"url--57174f1a-a47c-458d-9900-451e02de0b81",
"observed-data--57176bf7-4e28-4e60-88d4-4dea950d210f",
"domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f",
"observed-data--57176c2a-2280-4f00-9208-42c1950d210f",
"url--57176c2a-2280-4f00-9208-42c1950d210f",
"observed-data--57176c68-3b48-47d1-a549-4f20950d210f",
"network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
"ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
"observed-data--57176ca8-4fd8-4eac-a432-4fdb950d210f",
"url--57176ca8-4fd8-4eac-a432-4fdb950d210f",
"x-misp-attribute--57176d27-f044-4038-9604-49da950d210f",
"x-misp-attribute--57176d6e-a4e8-4c08-bd9c-41d9950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57174536-95fc-474a-bb9f-46dc950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T09:00:38.000Z",
"modified": "2016-04-20T09:00:38.000Z",
"first_observed": "2016-04-20T09:00:38Z",
"last_observed": "2016-04-20T09:00:38Z",
"number_observed": 1,
"object_refs": [
"file--57174536-95fc-474a-bb9f-46dc950d210f"
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload installation\""
]
},
{
"type": "file",
"spec_version": "2.1",
"id": "file--57174536-95fc-474a-bb9f-46dc950d210f",
"hashes": {
"MD5": "116d442d8ec5c62f32c7ba507a5569be"
}
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57174f19-f06c-4809-92b3-476d02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T09:42:49.000Z",
"modified": "2016-04-20T09:42:49.000Z",
"first_observed": "2016-04-20T09:42:49Z",
"last_observed": "2016-04-20T09:42:49Z",
"number_observed": 1,
"object_refs": [
"file--57174f19-f06c-4809-92b3-476d02de0b81"
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\""
]
},
{
"type": "file",
"spec_version": "2.1",
"id": "file--57174f19-f06c-4809-92b3-476d02de0b81",
"hashes": {
"SHA-256": "ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d"
}
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57174f19-c3d8-43f0-96bb-43e402de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T09:42:49.000Z",
"modified": "2016-04-20T09:42:49.000Z",
"first_observed": "2016-04-20T09:42:49Z",
"last_observed": "2016-04-20T09:42:49Z",
"number_observed": 1,
"object_refs": [
"file--57174f19-c3d8-43f0-96bb-43e402de0b81"
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload installation\""
]
},
{
"type": "file",
"spec_version": "2.1",
"id": "file--57174f19-c3d8-43f0-96bb-43e402de0b81",
"hashes": {
"SHA-1": "fb93796afa470d87deb316823d3cd6e8d8b18596"
}
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57174f1a-a47c-458d-9900-451e02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T09:42:50.000Z",
"modified": "2016-04-20T09:42:50.000Z",
"first_observed": "2016-04-20T09:42:50Z",
"last_observed": "2016-04-20T09:42:50Z",
"number_observed": 1,
"object_refs": [
"url--57174f1a-a47c-458d-9900-451e02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--57174f1a-a47c-458d-9900-451e02de0b81",
"value": "https://www.virustotal.com/file/ce98e9d9900609c45c948d34153c03b490bc2067e7a742048f60ed53fe95529d/analysis/1461016885/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57176bf7-4e28-4e60-88d4-4dea950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:45:59.000Z",
"modified": "2016-04-20T11:45:59.000Z",
"first_observed": "2016-04-20T11:45:59Z",
"last_observed": "2016-04-20T11:45:59Z",
"number_observed": 1,
"object_refs": [
"domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f"
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\""
]
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--57176bf7-4e28-4e60-88d4-4dea950d210f",
"value": "kentamplin.net"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57176c2a-2280-4f00-9208-42c1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:46:50.000Z",
"modified": "2016-04-20T11:46:50.000Z",
"first_observed": "2016-04-20T11:46:50Z",
"last_observed": "2016-04-20T11:46:50Z",
"number_observed": 1,
"object_refs": [
"url--57176c2a-2280-4f00-9208-42c1950d210f"
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--57176c2a-2280-4f00-9208-42c1950d210f",
"value": "kentamplin.net/wordpress/wp-includes/oops.php"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57176c68-3b48-47d1-a549-4f20950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:47:52.000Z",
"modified": "2016-04-20T11:47:52.000Z",
"first_observed": "2016-04-20T11:47:52Z",
"last_observed": "2016-04-20T11:47:52Z",
"number_observed": 1,
"object_refs": [
"network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
"ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f"
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\""
]
},
{
"type": "network-traffic",
"spec_version": "2.1",
"id": "network-traffic--57176c68-3b48-47d1-a549-4f20950d210f",
"dst_ref": "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
"protocols": [
"tcp"
]
},
{
"type": "ipv4-addr",
"spec_version": "2.1",
"id": "ipv4-addr--57176c68-3b48-47d1-a549-4f20950d210f",
"value": "192.185.16.132"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--57176ca8-4fd8-4eac-a432-4fdb950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:48:56.000Z",
"modified": "2016-04-20T11:48:56.000Z",
"first_observed": "2016-04-20T11:48:56Z",
"last_observed": "2016-04-20T11:48:56Z",
"number_observed": 1,
"object_refs": [
"url--57176ca8-4fd8-4eac-a432-4fdb950d210f"
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--57176ca8-4fd8-4eac-a432-4fdb950d210f",
"value": "http://192.185.16.132/wordpress/wp-includes/oops.php?id=2886098&cname=mh6SlMrX8b&arch=0&srv=0&ver=6.1"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--57176d27-f044-4038-9604-49da950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:51:03.000Z",
"modified": "2016-04-20T11:51:03.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"Other\""
],
"x_misp_category": "Other",
"x_misp_comment": "Ransom text",
"x_misp_type": "comment",
"x_misp_value": "YourID: 2886098\r\n PC: HOME\r\n USER: user\r\n *********\r\n Hey\r\n\r\n Your files are now encrypted. I have the key to decrypt them back. I will give you a decrypter if you pay me. Email me at: momsbestfriend@protonmail.com or torrenttracker@india.com\r\n\r\n If you don\u00e2\u20ac\u2122t get a reply or if both emails die, then contact me using a guaranteed, foolproof\r\n Bitmessage: download it form here https://github.com/mailchuck/PyBitmessage/releases/download/v0.5.8/Bitmessage-\r\n 0.5.8.exe\r\n\r\n Run it, click New Identity and then send me a message at BM-NBvzKEY8raDBKb9Gp1xZMRQpeU5svwg2\r\n\r\n Cheers"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--57176d6e-a4e8-4c08-bd9c-41d9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-04-20T11:52:14.000Z",
"modified": "2016-04-20T11:52:14.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"Other\""
],
"x_misp_category": "Other",
"x_misp_type": "comment",
"x_misp_value": "ID was seen to be same among the different infections..."
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink