667 lines
No EOL
30 KiB
JSON
667 lines
No EOL
30 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5a8ab58a-213c-409a-97af-4eb5950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:19:23.000Z",
|
|
"modified": "2018-02-19T15:19:23.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5a8ab58a-213c-409a-97af-4eb5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:19:23.000Z",
|
|
"modified": "2018-02-19T15:19:23.000Z",
|
|
"name": "OSINT - Zeus Panda Banking Trojan Targets Online Holiday Shoppers",
|
|
"published": "2018-02-19T15:19:35Z",
|
|
"object_refs": [
|
|
"observed-data--5a8ab5a6-dd34-43fe-84a6-4233950d210f",
|
|
"url--5a8ab5a6-dd34-43fe-84a6-4233950d210f",
|
|
"x-misp-attribute--5a8ab678-cbc8-44d5-a0fd-41dc950d210f",
|
|
"indicator--5a8ab749-7f88-4c4e-a793-468d950d210f",
|
|
"indicator--5a8ab749-c348-4a01-b3a1-49a2950d210f",
|
|
"indicator--5a8ab74a-24a0-4e16-9453-48d6950d210f",
|
|
"indicator--5a8ab74a-d460-4557-853d-4dd6950d210f",
|
|
"indicator--5a8ab74a-c27c-4d54-8ec7-4716950d210f",
|
|
"indicator--5a8ab74b-6054-4c91-83fb-47de950d210f",
|
|
"indicator--5a8abb27-77a0-4b68-9553-48b4950d210f",
|
|
"indicator--5a8abb28-1f88-407e-bb4d-4ae1950d210f",
|
|
"indicator--5a8abb28-90f8-4695-9b56-4c40950d210f",
|
|
"indicator--5a8abb90-0c54-4cdd-8bd4-4f25950d210f",
|
|
"indicator--5a8abcf9-ad74-4cf5-8f22-40bc950d210f",
|
|
"indicator--50729b03-af98-461f-8150-6bdcb9f28863",
|
|
"x-misp-object--72f529ad-3800-4a67-986c-5f156bacd531",
|
|
"indicator--e07dadcb-0ee5-41c3-9b1f-d16add57de72",
|
|
"x-misp-object--1887aa1b-d4c3-4054-8207-db4bbfae0f24",
|
|
"indicator--72cca599-0709-4d9d-82fc-809cf184fc48",
|
|
"x-misp-object--4135037a-5a4e-441d-86c3-76db0f601bfc",
|
|
"indicator--c18bd498-66d8-455d-9739-5eaacc9775ac",
|
|
"x-misp-object--acc53bbd-33bd-4719-a4a7-35c9937db841",
|
|
"relationship--a199c68e-6f51-4850-b748-e242803a2448",
|
|
"relationship--245fb11f-f4b6-4609-9478-7cf530bde08f",
|
|
"relationship--431fdcd5-48fb-44fc-8b94-85cf4a39b090",
|
|
"relationship--1a052620-3d93-4315-9ac8-4f36698b5de0"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:banker=\"Panda Banker\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"ms-caro-malware-full:malware-family=\"Banker\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5a8ab5a6-dd34-43fe-84a6-4233950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:19:01.000Z",
|
|
"modified": "2018-02-19T15:19:01.000Z",
|
|
"first_observed": "2018-02-19T15:19:01Z",
|
|
"last_observed": "2018-02-19T15:19:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5a8ab5a6-dd34-43fe-84a6-4233950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"estimative-language:likelihood-probability=\"very-likely\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5a8ab5a6-dd34-43fe-84a6-4233950d210f",
|
|
"value": "https://www.proofpoint.com/us/threat-insight/post/zeus-panda-banking-trojan-targets-online-holiday-shoppers"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5a8ab678-cbc8-44d5-a0fd-41dc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:19:20.000Z",
|
|
"modified": "2018-02-19T15:19:20.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"estimative-language:likelihood-probability=\"very-likely\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "Banking Trojans work by injecting code into web pages as they are viewed on infected machines, allowing the malware to harvest banking credentials and credit card information as victims interact with legitimate sites. Most often, the injects -- the code that actually performs the man-in-the-browser attacks -- are configured for region-specific banking sites. More recently, we have seen injects for online payment sites, casinos, retailers, and more appearing in banking Trojan campaigns.\r\n\r\nSince November -- a period of time that includes Thanksgiving, Black Friday, Cyber Monday and now leading up to Christmas -- we have observed Zeus Panda banking Trojan campaigns that have an increasing focus on non-banking targets with an extensive list of injects clearly designed to capitalize on holiday shopping and activities.\r\n\r\nMore specifically, these Zeus Panda (aka Panda Banker) campaigns expanded their injects to a variety of online shopping sites for brick and mortar retailers like Zara, specialty online retailers, travel sites, and video streaming sites, among others. The vast majority of these new targets will potentially see higher-than-normal numbers of credit card transactions for the holidays. While Zeus Panda can be configured to steal a variety of information, these injects collected the credit card number, address, phone number, DOB, SSN, and security question-related information such as mother\u00e2\u20ac\u2122s maiden name."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab749-7f88-4c4e-a793-468d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:55.000Z",
|
|
"modified": "2018-02-19T15:15:55.000Z",
|
|
"description": "December 11 campaign - Document payload",
|
|
"pattern": "[url:value = 'http://80.82.67.217/moo.jpg']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab749-c348-4a01-b3a1-49a2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T11:38:49.000Z",
|
|
"modified": "2018-02-19T11:38:49.000Z",
|
|
"description": "December 11 campaign - Panda",
|
|
"pattern": "[file:hashes.SHA256 = '5f7a1b02d5b2904554e65bd01a12f1fa5ff2121eef53f3942c4e9e29c46bdce3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T11:38:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab74a-24a0-4e16-9453-48d6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:55.000Z",
|
|
"modified": "2018-02-19T15:15:55.000Z",
|
|
"description": "December 11 campaign - Panda C&C",
|
|
"pattern": "[domain-name:value = 'gromnes.top']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab74a-d460-4557-853d-4dd6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:56.000Z",
|
|
"modified": "2018-02-19T15:15:56.000Z",
|
|
"description": "December 11 campaign - Panda C&C",
|
|
"pattern": "[domain-name:value = 'aklexim.top']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab74a-c27c-4d54-8ec7-4716950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:56.000Z",
|
|
"modified": "2018-02-19T15:15:56.000Z",
|
|
"description": "December 11 campaign - Panda C&C",
|
|
"pattern": "[domain-name:value = 'kichamyn.top']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8ab74b-6054-4c91-83fb-47de950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T11:38:51.000Z",
|
|
"modified": "2018-02-19T11:38:51.000Z",
|
|
"description": "December 11 campaign - Attachment",
|
|
"pattern": "[file:hashes.SHA256 = 'e13594d83f2a573627e742baf33298b9eeec1ebb8c7955304b8c35559e5f23dc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T11:38:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8abb27-77a0-4b68-9553-48b4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:57.000Z",
|
|
"modified": "2018-02-19T15:15:57.000Z",
|
|
"description": "November 13 campaign - Malicious URL in email",
|
|
"pattern": "[url:value = 'http://www.nfk-trading.com/analyticsmmrxbctq/redirect/0849e22e843170e1600c1910df8cf9da-id-qblozsmn-to-package-awaiting']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8abb28-1f88-407e-bb4d-4ae1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:57.000Z",
|
|
"modified": "2018-02-19T15:15:57.000Z",
|
|
"description": "November 13 campaign - Landing page redirection",
|
|
"pattern": "[url:value = 'https://canadapost-packagecenter.com/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8abb28-90f8-4695-9b56-4c40950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:57.000Z",
|
|
"modified": "2018-02-19T15:15:57.000Z",
|
|
"description": "November 13 campaign - \t Document payload",
|
|
"pattern": "[url:value = 'http://89.248.169.136/bigmac.jpg']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:15:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8abb90-0c54-4cdd-8bd4-4f25950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T11:57:04.000Z",
|
|
"modified": "2018-02-19T11:57:04.000Z",
|
|
"description": "November 13 campaign",
|
|
"pattern": "[file:hashes.SHA256 = '2514dbf1549b517692e415af85baa6e5eca926cdedb526d2e255b5943501d98b' AND file:name = 'receipt-package-5a0a062cae04a.doc' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T11:57:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5a8abcf9-ad74-4cf5-8f22-40bc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T12:03:05.000Z",
|
|
"modified": "2018-02-19T12:03:05.000Z",
|
|
"description": "November 13 campaign - Panda executable",
|
|
"pattern": "[file:hashes.SHA256 = 'ae92a4a5bc64db6af23219d7fa2d8bce98a5d7eb2eff7193e4f49698e3e5650d' AND file:name = 'Bigmac.jpg' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T12:03:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--50729b03-af98-461f-8150-6bdcb9f28863",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:01.000Z",
|
|
"modified": "2018-02-19T15:16:01.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a02d6ca05cbc89a317d82945bcb6b15b' AND file:hashes.SHA1 = '2cacb877c487b6dae47fb16fdd1dc7b05595125b' AND file:hashes.SHA256 = 'ae92a4a5bc64db6af23219d7fa2d8bce98a5d7eb2eff7193e4f49698e3e5650d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:16:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--72f529ad-3800-4a67-986c-5f156bacd531",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:15:59.000Z",
|
|
"modified": "2018-02-19T15:15:59.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ae92a4a5bc64db6af23219d7fa2d8bce98a5d7eb2eff7193e4f49698e3e5650d/analysis/1513357351/",
|
|
"category": "External analysis",
|
|
"uuid": "5a8aea2f-de34-4aea-90b8-429e02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "53/67",
|
|
"category": "Other",
|
|
"uuid": "5a8aea30-036c-4904-8e9e-44c902de0b81"
|
|
},
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2017-12-15T17:02:31",
|
|
"category": "Other",
|
|
"uuid": "5a8aea30-23e0-4d58-a38c-49ac02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e07dadcb-0ee5-41c3-9b1f-d16add57de72",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:03.000Z",
|
|
"modified": "2018-02-19T15:16:03.000Z",
|
|
"pattern": "[file:hashes.MD5 = '52b053886cc0ca44df86cba91de968fa' AND file:hashes.SHA1 = 'ef22bcec61cb2aea85cd93cede6af5f4b27e011b' AND file:hashes.SHA256 = '5f7a1b02d5b2904554e65bd01a12f1fa5ff2121eef53f3942c4e9e29c46bdce3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:16:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1887aa1b-d4c3-4054-8207-db4bbfae0f24",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:02.000Z",
|
|
"modified": "2018-02-19T15:16:02.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5f7a1b02d5b2904554e65bd01a12f1fa5ff2121eef53f3942c4e9e29c46bdce3/analysis/1517157632/",
|
|
"category": "External analysis",
|
|
"comment": "December 11 campaign - Panda",
|
|
"uuid": "5a8aea32-5c18-4193-9110-42f402de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "44/66",
|
|
"category": "Other",
|
|
"comment": "December 11 campaign - Panda",
|
|
"uuid": "5a8aea32-ff44-4c41-a670-454b02de0b81"
|
|
},
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-28T16:40:32",
|
|
"category": "Other",
|
|
"comment": "December 11 campaign - Panda",
|
|
"uuid": "5a8aea32-1c98-4f3a-ad90-48eb02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--72cca599-0709-4d9d-82fc-809cf184fc48",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:06.000Z",
|
|
"modified": "2018-02-19T15:16:06.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'b2a6ec17f49740ddc699640fb19f951d' AND file:hashes.SHA1 = '00d8ef79f6fe532815c0325fb6d7165cdae98548' AND file:hashes.SHA256 = 'e13594d83f2a573627e742baf33298b9eeec1ebb8c7955304b8c35559e5f23dc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:16:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--4135037a-5a4e-441d-86c3-76db0f601bfc",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:04.000Z",
|
|
"modified": "2018-02-19T15:16:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e13594d83f2a573627e742baf33298b9eeec1ebb8c7955304b8c35559e5f23dc/analysis/1515020239/",
|
|
"category": "External analysis",
|
|
"comment": "December 11 campaign - Attachment",
|
|
"uuid": "5a8aea34-d048-4db3-9e91-4a4502de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "30/60",
|
|
"category": "Other",
|
|
"comment": "December 11 campaign - Attachment",
|
|
"uuid": "5a8aea35-304c-45fe-99a1-4c1102de0b81"
|
|
},
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-03T22:57:19",
|
|
"category": "Other",
|
|
"comment": "December 11 campaign - Attachment",
|
|
"uuid": "5a8aea35-5e88-49aa-942f-4d3602de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c18bd498-66d8-455d-9739-5eaacc9775ac",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:08.000Z",
|
|
"modified": "2018-02-19T15:16:08.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'bcac60105cb24fdbcc03c1d52d09bfd1' AND file:hashes.SHA1 = '8eab9d3dfe6ac35a3624e916bb3cdc6d390a83d2' AND file:hashes.SHA256 = '2514dbf1549b517692e415af85baa6e5eca926cdedb526d2e255b5943501d98b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-02-19T15:16:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--acc53bbd-33bd-4719-a4a7-35c9937db841",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-02-19T15:16:07.000Z",
|
|
"modified": "2018-02-19T15:16:07.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/2514dbf1549b517692e415af85baa6e5eca926cdedb526d2e255b5943501d98b/analysis/1515420786/",
|
|
"category": "External analysis",
|
|
"uuid": "5a8aea38-a39c-4ff5-8186-43ae02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/60",
|
|
"category": "Other",
|
|
"uuid": "5a8aea38-7b60-4f34-9b25-4ea302de0b81"
|
|
},
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-08T14:13:06",
|
|
"category": "Other",
|
|
"uuid": "5a8aea38-bf00-4f32-a34e-456a02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a199c68e-6f51-4850-b748-e242803a2448",
|
|
"created": "2018-02-19T15:16:09.000Z",
|
|
"modified": "2018-02-19T15:16:09.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--50729b03-af98-461f-8150-6bdcb9f28863",
|
|
"target_ref": "x-misp-object--72f529ad-3800-4a67-986c-5f156bacd531"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--245fb11f-f4b6-4609-9478-7cf530bde08f",
|
|
"created": "2018-02-19T15:16:09.000Z",
|
|
"modified": "2018-02-19T15:16:09.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--e07dadcb-0ee5-41c3-9b1f-d16add57de72",
|
|
"target_ref": "x-misp-object--1887aa1b-d4c3-4054-8207-db4bbfae0f24"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--431fdcd5-48fb-44fc-8b94-85cf4a39b090",
|
|
"created": "2018-02-19T15:16:09.000Z",
|
|
"modified": "2018-02-19T15:16:09.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--72cca599-0709-4d9d-82fc-809cf184fc48",
|
|
"target_ref": "x-misp-object--4135037a-5a4e-441d-86c3-76db0f601bfc"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1a052620-3d93-4315-9ac8-4f36698b5de0",
|
|
"created": "2018-02-19T15:16:09.000Z",
|
|
"modified": "2018-02-19T15:16:09.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--c18bd498-66d8-455d-9739-5eaacc9775ac",
|
|
"target_ref": "x-misp-object--acc53bbd-33bd-4719-a4a7-35c9937db841"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |