908 lines
No EOL
38 KiB
JSON
908 lines
No EOL
38 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2021-05-24T09:48:49.000Z",
|
|
"modified": "2021-05-24T09:48:49.000Z",
|
|
"name": "Synovus Financial",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5b0438ad-6d20-4a53-9a8b-2c1c0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2021-05-24T09:48:49.000Z",
|
|
"modified": "2021-05-24T09:48:49.000Z",
|
|
"name": "Emotet 5-18-2018",
|
|
"published": "2020-05-11T07:55:59Z",
|
|
"object_refs": [
|
|
"indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
|
|
"indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
|
|
"indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
|
|
"indicator--5b0438c4-6724-4133-9846-2c420acd0835",
|
|
"indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
|
|
"indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
|
|
"indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
|
|
"indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
|
|
"indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
|
|
"indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
|
|
"indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
|
|
"indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
|
|
"indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
|
|
"indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
|
|
"indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
|
|
"indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
|
|
"indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
|
|
"indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
|
|
"indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
|
|
"indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
|
|
"indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
|
|
"observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
|
|
"url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
|
|
"indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
|
|
"indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
|
|
"indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
|
|
"indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
|
|
"indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
|
|
"indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
|
|
"indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
|
|
"indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
|
|
"indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
|
|
"indicator--5b043935-825c-49d4-b93c-08ef0acd0835"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:tool=\"Emotet\"",
|
|
"osint:source-type=\"pastie-website\"",
|
|
"osint:source-type=\"microblog-post\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-c7ac-49a6-b78f-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:41.000Z",
|
|
"modified": "2018-05-22T15:47:41.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.37.10.78' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-20f0-4baa-b9ad-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.84.214.74' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-1464-4a92-bcd8-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '65.25.17.131' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-6724-4133-9846-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '67.20.224.109' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-caf4-4260-a33f-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '69.129.91.38' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-6944-4ac5-bb83-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '70.167.17.7' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-fa54-4b42-a740-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '72.49.55.42' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-6978-4f21-8e03-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.209.63.166' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-5114-4463-aac3-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '105.228.39.7' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-a450-43be-80a9-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '119.18.8.51' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-b090-4a74-bec9-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:41.000Z",
|
|
"modified": "2018-05-22T15:47:41.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '169.0.250.138' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-7ed0-41b4-aa42-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '179.52.46.11' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-7444-4a71-a9d9-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '192.227.112.57' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-f0a0-46ed-8938-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '199.167.209.11' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-9548-496f-96fb-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '222.112.169.133' AND network-traffic:dst_port = '80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-2c44-4426-895e-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.120.170.231' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-4c8c-4d5e-b966-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '174.140.167.85' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c4-b078-43e2-9d5d-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.226.223.31' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438c5-fbd8-4d17-bb11-2c420acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:47:42.000Z",
|
|
"modified": "2018-05-22T15:47:42.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.160.93.187' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:47:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"veris:action:malware:variety=\"C2\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438d9-9b24-475a-9eb1-08ef0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://lemat.sk/YQJHmA']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b0438d9-ae60-4a28-b202-08ef0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b0438e9-88c4-4681-aa0b-2c060acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:42:18.000Z",
|
|
"modified": "2018-05-22T15:42:18.000Z",
|
|
"first_observed": "2018-05-22T15:42:18Z",
|
|
"last_observed": "2018-05-22T15:42:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b0438e9-88c4-4681-aa0b-2c060acd0835"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"Support Tool\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b0438e9-88c4-4681-aa0b-2c060acd0835",
|
|
"value": "https://www.virustotal.com/#/file/1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538/detection"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2d-d2e0-4a3a-a20f-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2d-6a18-4b90-b690-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://e-muhr.de/IcS1A5z/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2d-cc18-4e88-95f6-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://emulsiflex.com/Wz51Bq1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2d-6720-440e-a5c4-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://lemat.sk/YQJHmA/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2e-b2f8-4984-9875-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://columbiainstitute.org/O/YBC4RQ']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2e-ba3c-44c1-8389-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://sweatshop.org/dnqN0nl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2e-c00c-4b03-9b9d-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://www.gardonyrefhir.hu/gmQuF9x']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2e-aeac-4727-aa52-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://sweatshop.org/dnqN0nl/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043a2e-1968-4be5-a86d-2ade0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:48:33.000Z",
|
|
"modified": "2018-05-22T15:48:33.000Z",
|
|
"description": "Emotet",
|
|
"pattern": "[url:value = 'http://e-muhr.de/IcS1A5z']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:48:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"adversary:infrastructure-status=\"compromised\"",
|
|
"diamond-model:Infrastructure"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b043935-825c-49d4-b93c-08ef0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-05-22T15:37:25.000Z",
|
|
"modified": "2018-05-22T15:37:25.000Z",
|
|
"pattern": "[file:hashes.MD5 = '923a8d46eca1e77e020e0ac0951226d8' AND file:hashes.SHA1 = '45ef0de6aa324ebebdf9ba61129cd316e19973ae' AND file:hashes.SHA256 = '1b9e1f248b3dd13e0c8668117caa7f8af1e34918f1e9ac6f71d619e50fd91538' AND file:hashes.SSDEEP = '3072:8ZL3fu/kIS5c7+iMfmGkV1C5o63qaGymSUO:G0fac7Kflgao63qaGLS' AND file:name = '22468.exe' AND file:x_misp_text = 'Emotet' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-22T15:37:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |