1408 lines
No EOL
60 KiB
JSON
1408 lines
No EOL
60 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--59d68cfe-723c-4b5e-b737-fbfd02de0b81",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-06T09:52:59.000Z",
|
|
"modified": "2017-10-06T09:52:59.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--59d68cfe-723c-4b5e-b737-fbfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-06T09:52:59.000Z",
|
|
"modified": "2017-10-06T09:52:59.000Z",
|
|
"name": "OSINT - FreeMilk: A Highly Targeted Spear Phishing Campaign",
|
|
"published": "2017-10-06T09:53:07Z",
|
|
"object_refs": [
|
|
"observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81",
|
|
"url--59d68d30-fef8-46e2-8299-4c2b02de0b81",
|
|
"x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81",
|
|
"indicator--59d68def-93ac-417a-95dd-400802de0b81",
|
|
"indicator--59d68def-76dc-4ac8-8b0b-444802de0b81",
|
|
"indicator--59d68def-e5ec-416b-8650-45e502de0b81",
|
|
"indicator--59d68def-89dc-4632-8c84-4dfc02de0b81",
|
|
"indicator--59d68def-84a8-4265-94ec-49dd02de0b81",
|
|
"indicator--59d68def-6160-4073-8635-4de102de0b81",
|
|
"indicator--59d68def-3968-412f-82f1-4f8602de0b81",
|
|
"vulnerability--59d68e21-a364-43f8-b09e-421402de0b81",
|
|
"indicator--59d68ea6-7d58-426b-8637-403a02de0b81",
|
|
"indicator--59d68ea6-6038-4f14-b78f-42c102de0b81",
|
|
"indicator--59d68ecc-8668-4775-8992-fbfd02de0b81",
|
|
"indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81",
|
|
"indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81",
|
|
"indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81",
|
|
"indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81",
|
|
"indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81",
|
|
"indicator--59d68ef1-a150-4d30-a712-7ed002de0b81",
|
|
"indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81",
|
|
"indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81",
|
|
"indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81",
|
|
"indicator--59d68f38-6028-4934-8183-4cf702de0b81",
|
|
"indicator--59d68f38-2850-481e-8d9c-43bf02de0b81",
|
|
"observed-data--59d68f38-0658-420d-954b-4adf02de0b81",
|
|
"url--59d68f38-0658-420d-954b-4adf02de0b81",
|
|
"indicator--59d68f38-2664-4f17-a556-455502de0b81",
|
|
"indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81",
|
|
"observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81",
|
|
"url--59d68f38-ffc0-4f55-a249-475b02de0b81",
|
|
"indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81",
|
|
"indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81",
|
|
"observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81",
|
|
"url--59d68f38-1868-461e-bcf3-4e7502de0b81",
|
|
"indicator--59d68f38-4238-455f-9053-4ffb02de0b81",
|
|
"indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81",
|
|
"observed-data--59d68f38-a048-4780-96ff-4d9302de0b81",
|
|
"url--59d68f38-a048-4780-96ff-4d9302de0b81",
|
|
"indicator--59d68f38-83c8-41c6-8060-4ba402de0b81",
|
|
"indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81",
|
|
"observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
|
|
"url--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
|
|
"indicator--59d68f38-a88c-4685-9964-43cd02de0b81",
|
|
"indicator--59d68f38-c834-4724-8322-4b4b02de0b81",
|
|
"observed-data--59d68f38-a574-409c-979d-4d0402de0b81",
|
|
"url--59d68f38-a574-409c-979d-4d0402de0b81",
|
|
"indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81",
|
|
"indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81",
|
|
"observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
|
|
"url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
|
|
"indicator--59d68f38-9710-4f62-95af-44b002de0b81",
|
|
"indicator--59d68f38-c400-4825-bc49-456702de0b81",
|
|
"observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81",
|
|
"url--59d68f38-0d10-4f4f-859c-470a02de0b81",
|
|
"indicator--59d68f38-5044-4612-a378-484802de0b81",
|
|
"indicator--59d68f38-4eb8-4a29-8339-40b802de0b81",
|
|
"observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81",
|
|
"url--59d68f38-630c-481b-b4fb-4cdc02de0b81",
|
|
"indicator--59d68f38-c38c-4a45-98f7-462b02de0b81",
|
|
"indicator--59d68f38-ed5c-4691-a55d-489802de0b81",
|
|
"observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81",
|
|
"url--59d68f38-bcf0-4ab9-8041-447502de0b81",
|
|
"indicator--59d68f38-f18c-4d90-8c81-462102de0b81",
|
|
"indicator--59d68f38-5da0-4303-ae0c-408a02de0b81",
|
|
"observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81",
|
|
"url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68d30-fef8-46e2-8299-4c2b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68d30-fef8-46e2-8299-4c2b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68d30-fef8-46e2-8299-4c2b02de0b81",
|
|
"value": "https://researchcenter.paloaltonetworks.com/2017/10/unit42-freemilk-highly-targeted-spear-phishing-campaign/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--59d68d50-3d28-4831-8b96-fbfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "In May 2017, Palo Alto Networks Unit 42 identified a limited spear phishing campaign targeting various individuals across the world. The threat actor leveraged the CVE-2017-0199 Microsoft Word Office/WordPad Remote Code Execution Vulnerability with carefully crafted decoy content customized for each target recipient. Our research showed that the spear phishing emails came from multiple compromised email accounts tied to a legitimate domain in North East Asia. We believe that the threat actor hijacked an existing, legitimate in-progress conversation and posed as the legitimate senders to send malicious spear phishing emails to the recipients"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-93ac-417a-95dd-400802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "JavaScript to extract and run the payload",
|
|
"pattern": "[file:hashes.SHA256 = '1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-76dc-4ac8-8b0b-444802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[url:value = 'http://old.jrchina.com/btob_asiana/udel_ok.ipp']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-e5ec-416b-8650-45e502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "Fake image extracts to Freenki downloader",
|
|
"pattern": "[file:hashes.SHA256 = '64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-89dc-4632-8c84-4dfc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[url:value = 'http://old.jrchina.com/btob_asiana/appach01.jpg']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-84a8-4265-94ec-49dd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-6160-4073-8635-4de102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "PoohMilk loader",
|
|
"pattern": "[file:hashes.SHA256 = '40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68def-3968-412f-82f1-4f8602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--59d68e21-a364-43f8-b09e-421402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"name": "CVE-2017-0199",
|
|
"labels": [
|
|
"misp:type=\"vulnerability\"",
|
|
"misp:category=\"Payload delivery\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2017-0199"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ea6-7d58-426b-8637-403a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "Windows-KB276133-x86.exe",
|
|
"pattern": "[file:hashes.SHA256 = '1163da8c37ad9ba98d59b921ba8cf8e54bfc1282712cf754f4ff82b63f8e6027']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ea6-6038-4f14-b78f-42c102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-06T09:52:59.000Z",
|
|
"modified": "2017-10-06T09:52:59.000Z",
|
|
"description": "Windows-KB251952-x86.exe",
|
|
"pattern": "[file:hashes.SHA256 = 'ba5905c2fe46bd6734973139e759ba405fd193c2342dfcac396e9d529b57821b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-06T09:52:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\"",
|
|
"circl:incident-classification=\"malware\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ecc-8668-4775-8992-fbfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js",
|
|
"pattern": "[file:hashes.SHA256 = '99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-2558-4156-a0b7-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-ba78-4aec-8fd4-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-5fe8-475f-a18e-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-8a9c-40fa-96f0-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-cd70-4af0-81f9-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-a150-4d30-a712-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[domain-name:value = 'old.jrchina.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-0b54-4ac7-a770-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[domain-name:value = 'foodforu.heliohost.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-053c-4ed0-962d-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[domain-name:value = 'www.ethanpublishing.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68ef1-3c14-42eb-bad5-7ed002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"pattern": "[domain-name:value = 'discgolfglow.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-6028-4934-8183-4cf702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2",
|
|
"pattern": "[file:hashes.SHA1 = '67cd2e35fd6e06afe80724f53effabbfdf80349b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-2850-481e-8d9c-43bf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2",
|
|
"pattern": "[file:hashes.MD5 = '9f022df0bcfded9377baf4da1fbe7b8c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-0658-420d-954b-4adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-0658-420d-954b-4adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-0658-420d-954b-4adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/ef40f7ddff404d1193e025081780e32f88883fa4dd496f4189084d772a435cb2/analysis/1507220836/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-2664-4f17-a556-455502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9",
|
|
"pattern": "[file:hashes.SHA1 = 'f374436ec085e8bb254c3bf42d0dc84536cc4a90']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-2e9c-4f28-9978-4ee302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9",
|
|
"pattern": "[file:hashes.MD5 = '36ab73294dbbcdfe2554c5e29544de24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-ffc0-4f55-a249-475b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-ffc0-4f55-a249-475b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-ffc0-4f55-a249-475b02de0b81",
|
|
"value": "https://www.virustotal.com/file/34478d6692f8c28332751b31fd695b799d4ab36a8c12f7b728e2cb99ae2efcd9/analysis/1507217555/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-00f0-49aa-8d6f-4f0102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313",
|
|
"pattern": "[file:hashes.SHA1 = '419a86472fa374a333fd616152a4e1c2e94e8c8d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-0f68-4dcb-a9f9-478d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313",
|
|
"pattern": "[file:hashes.MD5 = 'fed4b7096553965a07e0f340494889fe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-1868-461e-bcf3-4e7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-1868-461e-bcf3-4e7502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-1868-461e-bcf3-4e7502de0b81",
|
|
"value": "https://www.virustotal.com/file/0f82ea2f92c7e906ee9ffbbd8212be6a8545b9bb0200eda09cce0ba9d7cb1313/analysis/1507217556/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-4238-455f-9053-4ffb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30",
|
|
"pattern": "[file:hashes.SHA1 = 'ad6fb28bd1eb1b992982648f0e78874e14e7b4ba']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-b6c8-4ecd-85ab-4d5e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30",
|
|
"pattern": "[file:hashes.MD5 = '53fb994908b72067bc3d2f6f93c0de7d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-a048-4780-96ff-4d9302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-a048-4780-96ff-4d9302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-a048-4780-96ff-4d9302de0b81",
|
|
"value": "https://www.virustotal.com/file/201b876bcb97f6c8972cc677bdf1e3e2b2f069ae2ec4653db8af4797884efa30/analysis/1506334002/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-83c8-41c6-8060-4ba402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a",
|
|
"pattern": "[file:hashes.SHA1 = 'abe2753ea8c2c54163703c4a3ca86ae25a0ce780']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-9ec0-4be5-995a-4d2d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a",
|
|
"pattern": "[file:hashes.MD5 = '321461c22c742328af1feb27a7c1c8e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-9c6c-46b1-80d4-45ff02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-9c6c-46b1-80d4-45ff02de0b81",
|
|
"value": "https://www.virustotal.com/file/a50543919c52ccaea40155ce35aa791bc86bd634240fb51922827223aca5c88a/analysis/1507233005/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-a88c-4685-9964-43cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5",
|
|
"pattern": "[file:hashes.SHA1 = 'f7fcadc8c71752ce5d47af1e8069069cc70e6e27']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-c834-4724-8322-4b4b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "http://www.ethanpublishing.com/ethanpublishing/phpcms/templates/default/member/pub/jquery_min_2.2.6.js - Xchecked via VT: 99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5",
|
|
"pattern": "[file:hashes.MD5 = '6c668fd6a98f0659abc54d88c1db209e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-a574-409c-979d-4d0402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-a574-409c-979d-4d0402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-a574-409c-979d-4d0402de0b81",
|
|
"value": "https://www.virustotal.com/file/99c1b4887d96cb94f32b280c1039b3a7e39ad996859ffa6dd011cf3cca4f1ba5/analysis/1507217555/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-ec2c-4ac1-bacb-489e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2",
|
|
"pattern": "[file:hashes.SHA1 = '011604ce0e46229ece8d9266d69d0e68d5931e72']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-a5e0-43e2-a403-4b1a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2",
|
|
"pattern": "[file:hashes.MD5 = '237ff78e9d8c9407f89563cb696c2539']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-d1a4-4ab2-a2cb-473c02de0b81",
|
|
"value": "https://www.virustotal.com/file/35273d6c25665a19ac14d469e1436223202be655ee19b5b247cb1afef626c9f2/analysis/1496397207/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-9710-4f62-95af-44b002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574",
|
|
"pattern": "[file:hashes.SHA1 = 'aa84276ca9a6ad2f644f927cc14c9bff09595d92']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-c400-4825-bc49-456702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "PoohMilk loader - Xchecked via VT: 40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574",
|
|
"pattern": "[file:hashes.MD5 = 'f5cae9fcc8bad42b3dddb71ce68dbd92']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-0d10-4f4f-859c-470a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-0d10-4f4f-859c-470a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-0d10-4f4f-859c-470a02de0b81",
|
|
"value": "https://www.virustotal.com/file/40572e1fc37f4376fdb2a33a6c376631ff7bc00b1e64538a0385bc1e09a85574/analysis/1503367656/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-5044-4612-a378-484802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df",
|
|
"pattern": "[file:hashes.SHA1 = '0f97d50ca513c6899204b59d594a0537a14aa81f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-4eb8-4a29-8339-40b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "- Xchecked via VT: 7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df",
|
|
"pattern": "[file:hashes.MD5 = 'f5463cd95632706cd7823bfea8fc118c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-630c-481b-b4fb-4cdc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-630c-481b-b4fb-4cdc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-630c-481b-b4fb-4cdc02de0b81",
|
|
"value": "https://www.virustotal.com/file/7f35521cdbaa4e86143656ff9c52cef8d1e5e5f8245860c205364138f82c54df/analysis/1502302846/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-c38c-4a45-98f7-462b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c",
|
|
"pattern": "[file:hashes.SHA1 = '5bb865a0518862c9b47e678446e9968b8e2d0bed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-ed5c-4691-a55d-489802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "Fake image extracts to Freenki downloader - Xchecked via VT: 64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c",
|
|
"pattern": "[file:hashes.MD5 = '7c2ebfc7960aac6f8d58b37e3f092a9c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-bcf0-4ab9-8041-447502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-bcf0-4ab9-8041-447502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-bcf0-4ab9-8041-447502de0b81",
|
|
"value": "https://www.virustotal.com/file/64ef80e7639c8c5dddf239883617e6740c6b3589f995d11314d36ab64fcfc54c/analysis/1502714265/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-f18c-4d90-8c81-462102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c",
|
|
"pattern": "[file:hashes.SHA1 = '73f84a1bfb63c06c43d570dd6fd0f08b14c2b7c6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59d68f38-5da0-4303-ae0c-408a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"description": "JavaScript to extract and run the payload - Xchecked via VT: 1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c",
|
|
"pattern": "[file:hashes.MD5 = 'ab4596f26b25730fbc9dc41e629980f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-10-05T19:59:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59d68f38-f7b0-4bcf-bf68-414702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-10-05T19:59:52.000Z",
|
|
"modified": "2017-10-05T19:59:52.000Z",
|
|
"first_observed": "2017-10-05T19:59:52Z",
|
|
"last_observed": "2017-10-05T19:59:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59d68f38-f7b0-4bcf-bf68-414702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59d68f38-f7b0-4bcf-bf68-414702de0b81",
|
|
"value": "https://www.virustotal.com/file/1893af524edea4541c317df288adbf17ae4fcc3a30d403331eae541281c71a3c/analysis/1502714265/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |