adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/582ab037-052c-483d-803c-4174950d210f.json

418 lines
No EOL
18 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--582ab037-052c-483d-803c-4174950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:32.000Z",
"modified": "2016-11-15T06:54:32.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--582ab037-052c-483d-803c-4174950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:32.000Z",
"modified": "2016-11-15T06:54:32.000Z",
"name": "OSINT - Ransoc Desktop Locking Ransomware Ransacks Local Files and Social Media Profiles",
"published": "2016-11-15T06:56:13Z",
"object_refs": [
"observed-data--582ab080-fe34-4b1d-8239-4978950d210f",
"url--582ab080-fe34-4b1d-8239-4978950d210f",
"x-misp-attribute--582ab095-8cf8-459b-a286-425f950d210f",
"indicator--582ab0e7-bdc4-4195-b375-40b2950d210f",
"indicator--582ab0e8-98e0-4bd3-8148-4518950d210f",
"indicator--582ab0e8-6d20-4897-8b2a-4f87950d210f",
"indicator--582ab0e8-0b08-4854-9a4d-4f18950d210f",
"indicator--582ab0e8-ecf4-49ba-9439-4b8b950d210f",
"indicator--582ab0e9-6444-4e74-bc0a-49cc950d210f",
"indicator--582ab0e9-0808-418b-af49-499b950d210f",
"indicator--582ab0e9-0a44-4930-a673-44ba950d210f",
"indicator--582ab0e9-76dc-4b25-b066-4236950d210f",
"indicator--582ab11f-9020-4af4-994a-4b12950d210f",
"indicator--582ab128-13e4-458e-a37c-414e02de0b81",
"indicator--582ab129-dd7c-4b36-9f3b-422e02de0b81",
"observed-data--582ab129-58ac-41fd-9807-480502de0b81",
"url--582ab129-58ac-41fd-9807-480502de0b81"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"ecsirt:malicious-code=\"ransomware\"",
"veris:action:malware:variety=\"Ransomware\"",
"malware_classification:malware-category=\"Ransomware\"",
"ms-caro-malware:malware-type=\"Ransom\"",
"enisa:nefarious-activity-abuse=\"ransomware\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--582ab080-fe34-4b1d-8239-4978950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:51:44.000Z",
"modified": "2016-11-15T06:51:44.000Z",
"first_observed": "2016-11-15T06:51:44Z",
"last_observed": "2016-11-15T06:51:44Z",
"number_observed": 1,
"object_refs": [
"url--582ab080-fe34-4b1d-8239-4978950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--582ab080-fe34-4b1d-8239-4978950d210f",
"value": "https://www.proofpoint.com/us/threat-insight/post/ransoc-desktop-locking-ransomware-ransacks-local-files-social-media-profiles"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--582ab095-8cf8-459b-a286-425f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:52:05.000Z",
"modified": "2016-11-15T06:52:05.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Ransomware has exploded in the last year, becoming the malware of choice for many threat actors because of its easy monetization and ease of distribution, whether via massive email campaigns or through a variety of exploit kits. Proofpoint research suggests that the number of ransomware variants has grown tenfold since December 2015. While most such malware encrypts a victim's files and demands that a ransom be paid in Bitcoins to decrypt them, Proofpoint researchers recently discovered a new variant that scrapes Skype and social media profiles for personal information while it scans files and torrents for potentially sensitive information. Instead of encrypting files, it threatens victims with fake legal proceedings if they fail to pay the ransom."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e7-bdc4-4195-b375-40b2950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:27.000Z",
"modified": "2016-11-15T06:53:27.000Z",
"description": "5.45.86.171 \t Browlock for IE Windows",
"pattern": "[domain-name:value = 'cis-criminal-report.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:27Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e8-98e0-4bd3-8148-4518950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:28.000Z",
"modified": "2016-11-15T06:53:28.000Z",
"description": "Browlock for IE Windows",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.45.86.171']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e8-6d20-4897-8b2a-4f87950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:28.000Z",
"modified": "2016-11-15T06:53:28.000Z",
"description": "5.45.86.171 \t Browlock for IE Windows",
"pattern": "[domain-name:value = 'criminal-report.in']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e8-0b08-4854-9a4d-4f18950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:28.000Z",
"modified": "2016-11-15T06:53:28.000Z",
"description": "5.45.86.171 \t Browlock for IE Windows",
"pattern": "[domain-name:value = 'violation-report.in']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e8-ecf4-49ba-9439-4b8b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:28.000Z",
"modified": "2016-11-15T06:53:28.000Z",
"description": "78.47.134.204 \t Intermediate Redirector/TDS",
"pattern": "[domain-name:value = 'latexfetishsex.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:28Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e9-6444-4e74-bc0a-49cc950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:29.000Z",
"modified": "2016-11-15T06:53:29.000Z",
"description": "Intermediate Redirector/TDS",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '78.47.134.204']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e9-0808-418b-af49-499b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:29.000Z",
"modified": "2016-11-15T06:53:29.000Z",
"description": "5.9.86.131 \t Intermediate Redirector/TDS",
"pattern": "[domain-name:value = 'italy-girls.mobi']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e9-0a44-4930-a673-44ba950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:29.000Z",
"modified": "2016-11-15T06:53:29.000Z",
"description": "Intermediate Redirector/TDS",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.9.86.131']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab0e9-76dc-4b25-b066-4236950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:53:29.000Z",
"modified": "2016-11-15T06:53:29.000Z",
"description": "IP found in the Ransoc",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.45.86.148']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:53:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab11f-9020-4af4-994a-4b12950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:23.000Z",
"modified": "2016-11-15T06:54:23.000Z",
"description": "Ransoc PenaltyNotice",
"pattern": "[file:hashes.SHA256 = 'fee53dc4e165b2aa45c3e7bd100b49c367aa8b7f81757617114ff50a584a1566']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:54:23Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab128-13e4-458e-a37c-414e02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:32.000Z",
"modified": "2016-11-15T06:54:32.000Z",
"description": "Ransoc PenaltyNotice - Xchecked via VT: fee53dc4e165b2aa45c3e7bd100b49c367aa8b7f81757617114ff50a584a1566",
"pattern": "[file:hashes.SHA1 = '44fd0e2d99d6ccc49db7b48d5fc49e74c54f4463']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:54:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--582ab129-dd7c-4b36-9f3b-422e02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:32.000Z",
"modified": "2016-11-15T06:54:32.000Z",
"description": "Ransoc PenaltyNotice - Xchecked via VT: fee53dc4e165b2aa45c3e7bd100b49c367aa8b7f81757617114ff50a584a1566",
"pattern": "[file:hashes.MD5 = '30bf1d54830eb4223f0f3e68d113ff5d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-11-15T06:54:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--582ab129-58ac-41fd-9807-480502de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-11-15T06:54:33.000Z",
"modified": "2016-11-15T06:54:33.000Z",
"first_observed": "2016-11-15T06:54:33Z",
"last_observed": "2016-11-15T06:54:33Z",
"number_observed": 1,
"object_refs": [
"url--582ab129-58ac-41fd-9807-480502de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--582ab129-58ac-41fd-9807-480502de0b81",
"value": "https://www.virustotal.com/file/fee53dc4e165b2aa45c3e7bd100b49c367aa8b7f81757617114ff50a584a1566/analysis/1479181529/"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink