4652 lines
No EOL
201 KiB
JSON
4652 lines
No EOL
201 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5c9b92ae-0428-46ef-9ced-4d47950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-05T06:33:52.000Z",
|
|
"modified": "2019-04-05T06:33:52.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "grouping",
|
|
"spec_version": "2.1",
|
|
"id": "grouping--5c9b92ae-0428-46ef-9ced-4d47950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-05T06:33:52.000Z",
|
|
"modified": "2019-04-05T06:33:52.000Z",
|
|
"name": "Bulletin d\u2019actualit\u00e9 CERTFR-2019-ACT-005",
|
|
"context": "suspicious-activity",
|
|
"object_refs": [
|
|
"observed-data--5c9c7c27-f578-43fb-8950-f682950d210f",
|
|
"url--5c9c7c27-f578-43fb-8950-f682950d210f",
|
|
"observed-data--5c9c80a8-de8c-4737-92ae-4250950d210f",
|
|
"url--5c9c80a8-de8c-4737-92ae-4250950d210f",
|
|
"indicator--5c9c9c28-b844-44bf-91d9-45c5950d210f",
|
|
"indicator--5c9c9c28-2aa0-4318-b516-44f8950d210f",
|
|
"x-misp-attribute--5c9ca433-92e0-4c95-a054-4528950d210f",
|
|
"indicator--5c9cdbca-78dc-499a-86a2-4d6e950d210f",
|
|
"indicator--5c9cdbca-0e04-42d7-ab25-4e14950d210f",
|
|
"indicator--5c9cdcc4-d2dc-4f8c-8947-43c0950d210f",
|
|
"indicator--5c9cdcc7-8654-45c7-b3b1-440b950d210f",
|
|
"indicator--5c9cdccf-0b50-4881-8bfe-4b34950d210f",
|
|
"indicator--5c9cdcd0-3b78-4d12-b3c2-42ea950d210f",
|
|
"indicator--5c9cdcd0-2d68-4958-8ea1-4cc3950d210f",
|
|
"indicator--5c9cdcd0-4e7c-4567-a324-4a7d950d210f",
|
|
"x-misp-attribute--5c9e39dc-a38c-422e-903f-4831950d210f",
|
|
"indicator--5ca1b269-0aa4-479e-80c5-457a950d210f",
|
|
"indicator--5ca1b269-97c8-4a64-aec2-46f0950d210f",
|
|
"indicator--5ca1b269-b02c-43ad-afbd-4f69950d210f",
|
|
"indicator--5ca1b269-01f8-4c66-b7a6-4318950d210f",
|
|
"indicator--5ca1b269-6478-47f0-a5cd-4e8f950d210f",
|
|
"indicator--5ca1b269-9670-48a3-8bbe-4639950d210f",
|
|
"indicator--5ca1b269-f7fc-4efd-9e26-4955950d210f",
|
|
"indicator--5ca1b269-eb04-4df7-8a0b-41d9950d210f",
|
|
"indicator--5ca1ce9d-cd4c-46b6-9a6a-3ff6950d210f",
|
|
"indicator--5ca1ce9d-b568-4caf-bdff-3ff6950d210f",
|
|
"indicator--5ca1d8cb-4e80-4388-9890-d6af950d210f",
|
|
"indicator--5ca1d8cb-e228-4161-9aa7-d6af950d210f",
|
|
"indicator--5ca1d8cb-f2a0-4fca-a92a-d6af950d210f",
|
|
"indicator--5ca1d8cb-69b8-4968-9f67-d6af950d210f",
|
|
"indicator--5ca1d8cb-1654-4bf2-b765-d6af950d210f",
|
|
"indicator--5ca1d8cb-3414-41ec-9f72-d6af950d210f",
|
|
"indicator--5ca1d8cb-8b64-4abe-87e7-d6af950d210f",
|
|
"indicator--5ca1d8cb-121c-4714-aa3e-d6af950d210f",
|
|
"indicator--5ca1d8cb-a8d8-46e0-aa54-d6af950d210f",
|
|
"indicator--5ca1d8cb-6ed8-400b-b4fa-d6af950d210f",
|
|
"indicator--5ca1d8cb-d90c-47f7-94c8-d6af950d210f",
|
|
"indicator--5ca1d8cb-27c4-4c61-a7ef-d6af950d210f",
|
|
"indicator--5ca1d8cc-5548-451c-9747-d6af950d210f",
|
|
"indicator--5ca1d8cc-c67c-4701-8470-d6af950d210f",
|
|
"indicator--5ca1d8cc-a450-4ef1-a1bb-d6af950d210f",
|
|
"indicator--5ca1d8cc-f1c0-4dfc-85f9-d6af950d210f",
|
|
"indicator--5ca1d8cc-5104-424c-bb78-d6af950d210f",
|
|
"indicator--5ca1d8cc-2b0c-4ab6-9304-d6af950d210f",
|
|
"indicator--5ca1d8cc-dc90-45a2-a6bf-d6af950d210f",
|
|
"indicator--5ca1d8cc-fb50-48bc-8dbb-d6af950d210f",
|
|
"indicator--5ca1d8cc-c190-4f11-9122-d6af950d210f",
|
|
"indicator--5ca1d8cc-c2f0-469e-8883-d6af950d210f",
|
|
"indicator--5ca1d8cc-0cd4-4431-a10f-d6af950d210f",
|
|
"indicator--5ca1d8cc-6270-48ed-af05-d6af950d210f",
|
|
"indicator--5ca1d8cc-dedc-4b55-ab68-d6af950d210f",
|
|
"indicator--5ca1d8cc-3284-4bbd-a95a-d6af950d210f",
|
|
"indicator--5ca1d8cc-589c-4067-adcd-d6af950d210f",
|
|
"indicator--5ca1d8cc-ac04-4efc-a767-d6af950d210f",
|
|
"indicator--5ca1d8cc-4df0-408a-8b83-d6af950d210f",
|
|
"indicator--5ca1d8cc-f428-494a-86ac-d6af950d210f",
|
|
"indicator--5ca1d8cc-2d24-4de1-8232-d6af950d210f",
|
|
"indicator--5ca1d8cc-c530-4ce4-9202-d6af950d210f",
|
|
"indicator--5ca1d8cc-5c10-4070-aebe-d6af950d210f",
|
|
"indicator--5ca1d8cc-55a0-4f8a-baf7-d6af950d210f",
|
|
"indicator--5ca1d8cc-84f4-476c-8619-d6af950d210f",
|
|
"indicator--5ca1d8cc-4490-4918-ac84-d6af950d210f",
|
|
"indicator--5ca1e082-87c0-4e54-891a-4dba950d210f",
|
|
"indicator--5ca1e082-c73c-48e1-91c2-4875950d210f",
|
|
"indicator--5ca1e082-a4c8-4094-be2e-4276950d210f",
|
|
"indicator--5ca1e082-df5c-42e5-95c1-43ca950d210f",
|
|
"indicator--5ca1e082-2f08-4f8b-a82a-4d65950d210f",
|
|
"indicator--5ca1e082-08fc-4585-83d4-47c7950d210f",
|
|
"indicator--5ca1e082-1960-4f42-89e3-4a5c950d210f",
|
|
"indicator--5ca1e082-5a98-4ee3-afa7-48c0950d210f",
|
|
"indicator--5ca1e082-9dc4-4403-aaaa-406e950d210f",
|
|
"indicator--5ca1e082-1610-4df6-9bd7-4a89950d210f",
|
|
"indicator--5ca1e082-0ebc-43d4-b476-48ea950d210f",
|
|
"indicator--5ca1e082-aa0c-48ab-ac8e-4840950d210f",
|
|
"indicator--5ca1e082-fed8-4893-b9c4-4dc7950d210f",
|
|
"indicator--5ca1e082-e1c8-4d0d-8458-41eb950d210f",
|
|
"indicator--5ca1e082-72d0-49db-8909-4523950d210f",
|
|
"indicator--5ca1e082-7dfc-43c5-864b-494c950d210f",
|
|
"indicator--5ca1e082-4b0c-4376-89e9-4075950d210f",
|
|
"indicator--5ca1e082-c614-431c-b553-4eff950d210f",
|
|
"indicator--5ca1e719-4834-41f6-be6d-4586950d210f",
|
|
"indicator--5ca1e719-db18-46a6-9d1c-4acc950d210f",
|
|
"indicator--5ca1e719-819c-451a-9977-400e950d210f",
|
|
"indicator--5ca1e719-ffe4-4586-9f65-4c75950d210f",
|
|
"indicator--5ca1e719-0af8-451f-9ab5-4828950d210f",
|
|
"indicator--5ca1e71a-e47c-45fa-95f8-4ebc950d210f",
|
|
"indicator--5ca1e71a-eb68-4e2f-afb1-405c950d210f",
|
|
"indicator--5ca1e71a-4378-412c-acbe-499f950d210f",
|
|
"indicator--5ca21226-bc58-47e2-bc18-4c09950d210f",
|
|
"indicator--5ca21226-ff2c-4002-91db-40b4950d210f",
|
|
"indicator--5ca21226-c4bc-43b0-b0da-40a8950d210f",
|
|
"indicator--5ca61559-4fd4-4df0-976e-43ba950d210f",
|
|
"indicator--5c9c866a-b3b4-41e8-9594-f646950d210f",
|
|
"indicator--5c9c882a-a40c-46db-a3f5-f383950d210f",
|
|
"indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f",
|
|
"indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f",
|
|
"indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f",
|
|
"indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f",
|
|
"indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f",
|
|
"indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f",
|
|
"indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f",
|
|
"indicator--5c9cdeef-4adc-461d-9b72-4062950d210f",
|
|
"indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f",
|
|
"indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f",
|
|
"indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f",
|
|
"indicator--5c9e3b43-3128-4838-8d63-4a69950d210f",
|
|
"indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f",
|
|
"indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f",
|
|
"indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f",
|
|
"indicator--5ca5e3be-9cc4-4a68-939e-bac6950d210f",
|
|
"indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a",
|
|
"x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7",
|
|
"indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1",
|
|
"x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989",
|
|
"indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18",
|
|
"x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8",
|
|
"indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033",
|
|
"x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9",
|
|
"indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216",
|
|
"x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab",
|
|
"x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2",
|
|
"x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370",
|
|
"x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb",
|
|
"x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1",
|
|
"x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d",
|
|
"x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9",
|
|
"x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e",
|
|
"x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87",
|
|
"x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3",
|
|
"x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044",
|
|
"x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0",
|
|
"x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d",
|
|
"x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7",
|
|
"x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0",
|
|
"x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de",
|
|
"indicator--b6346b5e-5482-4314-9d7b-8671c4155bf1",
|
|
"indicator--d74356f9-39d2-4c30-9711-8ed1a401acd3",
|
|
"indicator--e668ce8c-af43-4832-89b2-9c08e3f5124c",
|
|
"indicator--6e1a65fa-acb6-4ea6-a06b-636c428138b5",
|
|
"indicator--f7e26e48-37f4-45a8-8a1c-2ecc11dec53a",
|
|
"indicator--d4db8abd-f691-4927-9e28-14ce0ee7d430",
|
|
"indicator--3d49a49b-5bc6-49be-a0e6-ab3b72ccfe46",
|
|
"indicator--f898f5e1-93e1-458b-996c-ebc6dba13222",
|
|
"indicator--89b53bf3-e0c4-4f48-8e25-ff54844fae43",
|
|
"indicator--1162a78a-804d-4856-82b3-0b77509bcfe7",
|
|
"indicator--bf5439e4-3e35-44a0-9ff3-129042947aad",
|
|
"indicator--02af3be3-4a7e-4a84-81eb-83f604a3f0a5",
|
|
"indicator--dae97fa0-3eb3-4915-82cc-e7e489d64dd1",
|
|
"indicator--24e6319c-f91c-43b2-a9d3-7b0bfd5a76a7",
|
|
"indicator--3dac003b-a958-48e2-8a96-6d0fdba7875d",
|
|
"indicator--c01e648d-7f49-45f7-b7d7-48ce5a507a47",
|
|
"indicator--ac91f1d9-024c-44e2-8a7c-06172796ea12",
|
|
"indicator--2ba4112d-7327-4b19-8035-a2e6eb73d573",
|
|
"indicator--7f430f07-3ff9-4553-b81a-36681949c447",
|
|
"indicator--6fe2ec22-3ff6-4a79-af8e-30e6a5253e45",
|
|
"indicator--b14e7307-30f6-49c8-b4fe-0b6735a3a94d",
|
|
"indicator--3549d1ed-c1c7-4066-a9cc-9d0a86cd8e0a",
|
|
"indicator--eaa8dc3c-16ef-45eb-add4-3d736d1bd330",
|
|
"indicator--7e91cd8c-c822-43fe-ac0b-5d137f57bc3a",
|
|
"indicator--7b59d923-d374-41bc-89b7-e68498bacc72",
|
|
"indicator--4b9fdc52-1ce3-45d7-85cc-60215eb30f0c",
|
|
"indicator--fa63b93f-2201-4f6c-8341-4a86980805b3",
|
|
"indicator--c73504a4-60da-4107-adef-c10a0f52266b",
|
|
"indicator--edbac896-cf24-4628-9064-7bac3c8e8d58",
|
|
"indicator--d91eacd1-efda-4eaf-ae5a-f815869b10dd",
|
|
"indicator--a1a25873-3445-4873-8b6b-7dca2e15615a",
|
|
"indicator--9aa33ad7-9f08-4774-b109-cedaed81cd60",
|
|
"indicator--dc691061-1ee8-46b1-b3ef-488f082e45c8",
|
|
"indicator--8d31887c-d4a7-4e7f-899c-df1d3a41e15f",
|
|
"indicator--febd2cf8-35c9-49d2-9963-21b43acb6f04",
|
|
"indicator--f63b62d9-f5f1-4c51-9488-139d016e7660",
|
|
"relationship--befab1a1-2b4a-4540-952a-922278cf82c0",
|
|
"relationship--d6c71559-29b0-48dd-9236-20c9f79ac1e1",
|
|
"relationship--9aad7daf-6c59-4867-ba46-3232293ee3a8",
|
|
"relationship--724f2840-888d-4639-85c8-a1eca39cc5ca",
|
|
"relationship--0a6c6598-6f22-4d03-af41-5e2cdf61caae",
|
|
"relationship--9af6cf96-af83-44ac-81a6-f8fbbcd8ce22",
|
|
"relationship--a0a026c0-bd52-480a-9e06-184b87fccd01",
|
|
"relationship--b82b8365-592c-429b-b8be-8b675cf76c24",
|
|
"relationship--c8739605-5978-45e9-bdee-187564723288",
|
|
"relationship--20d02435-b817-4bf1-9c03-bddbd24b0212",
|
|
"relationship--419f5108-66d9-4623-b8a6-0d56789b4d9f",
|
|
"relationship--96177536-f8e7-4ffb-8771-69feda28cc02",
|
|
"relationship--f9305cde-1e4d-45bd-a0ca-cc4176c807fb",
|
|
"relationship--9afb5fff-3b1d-42e8-9c36-9c612422b106",
|
|
"relationship--cd469e0b-49ca-4af6-8603-4f2297e9cc79",
|
|
"relationship--9304643c-6881-41e3-9198-04c65d84152b",
|
|
"relationship--1a430efa-100e-405b-8264-4b85ee5665dc",
|
|
"relationship--4b98aec3-9c78-4ac5-aee1-24e43314c48f",
|
|
"relationship--d5fa14a8-ad21-4a78-8857-f209ef41a16a",
|
|
"relationship--215abfc9-1d9c-482b-9b7e-0439fb0c579f",
|
|
"relationship--948a3baa-9eed-495e-8bb6-aa62dd820348"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:malpedia=\"Ryuk\"",
|
|
"misp-galaxy:ransomware=\"LockerGoga\"",
|
|
"misp-galaxy:ransomware=\"Ryuk ransomware\"",
|
|
"type:OSINT",
|
|
"osint:lifetime=\"perpetual\"",
|
|
"osint:certainty=\"50\"",
|
|
"misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"",
|
|
"misp-galaxy:mitre-tool=\"Cobalt Strike\"",
|
|
"misp-galaxy:rat=\"Cobalt Strike\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5c9c7c27-f578-43fb-8950-f682950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-05T06:33:52.000Z",
|
|
"modified": "2019-04-05T06:33:52.000Z",
|
|
"first_observed": "2019-04-05T06:33:52Z",
|
|
"last_observed": "2019-04-05T06:33:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5c9c7c27-f578-43fb-8950-f682950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5c9c7c27-f578-43fb-8950-f682950d210f",
|
|
"value": "https://www.cert.ssi.gouv.fr/actualite/CERTFR-2019-ACT-005/"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5c9c80a8-de8c-4737-92ae-4250950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T08:07:20.000Z",
|
|
"modified": "2019-03-28T08:07:20.000Z",
|
|
"first_observed": "2019-03-28T08:07:20Z",
|
|
"last_observed": "2019-03-28T08:07:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5c9c80a8-de8c-4737-92ae-4250950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"technical-report\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5c9c80a8-de8c-4737-92ae-4250950d210f",
|
|
"value": "https://www.cert.ssi.gouv.fr/uploads/CERTFR-2019-ACT-005.pdf"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9c9c28-b844-44bf-91d9-45c5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T10:04:24.000Z",
|
|
"modified": "2019-03-28T10:04:24.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'cottleakela@protonmail.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T10:04:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9c9c28-2aa0-4318-b516-44f8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T10:04:24.000Z",
|
|
"modified": "2019-03-28T10:04:24.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'qyavauzehyco1994@o2.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T10:04:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5c9ca433-92e0-4c95-a054-4528950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T10:38:43.000Z",
|
|
"modified": "2019-03-28T10:38:43.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"Artifacts dropped\""
|
|
],
|
|
"x_misp_category": "Artifacts dropped",
|
|
"x_misp_comment": "Ransomnote",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "Greetings!There was a significant flaw in the security system of your company.\r\nYou should be thankful that the flaw was exploited by serious people and not some rookies.\r\nThey would have damaged all of your data by mistake or for fun.\r\n\r\nYour files are encrypted with the strongest military algorithms RSA4096 and AES-256.\r\nWithout our special decoder it is impossible to restore the data.\r\nAttempts to restore your data with third party software as Photorec, RannohDecryptor etc.\r\nwill lead to irreversible destruction of your data.\r\n\r\nTo confirm our honest intentions.\r\nSend us 2-3 different random files and you will get them decrypted.\r\nIt can be from different computers on your network to be sure that our decoder decrypts everything.\r\nSample files we unlock for free (files should not be related to any kind of backups).\r\n\r\nWe exclusively have decryption software for your situation\r\n\r\nDO NOT RESET OR SHUTDOWN - files may be damaged.\r\nDO NOT RENAME the encrypted files.\r\nDO NOT MOVE the encrypted files.\r\nThis may lead to the impossibility of recovery of the certain files.\r\n\r\nTo get information on the price of the decoder contact us at:\r\nCottleAkela@protonmail.com;QyavauZehyco1994@o2.pl\r\nThe payment has to be made in Bitcoins.\r\nThe final price depends on how fast you contact us.\r\nAs soon as we receive the payment you will get the decryption tool and\r\ninstructions on how to improve your systems security"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdbca-78dc-499a-86a2-4d6e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:35:54.000Z",
|
|
"modified": "2019-03-28T14:35:54.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'abbschevis@protonmail.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:35:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdbca-0e04-42d7-ab25-4e14950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:35:54.000Z",
|
|
"modified": "2019-03-28T14:35:54.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'ijuqodisunovib98@o2.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:35:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdcc4-d2dc-4f8c-8947-43c0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:04.000Z",
|
|
"modified": "2019-03-28T14:40:04.000Z",
|
|
"pattern": "[domain-name:value = 'protonmail.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdcc7-8654-45c7-b3b1-440b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:07.000Z",
|
|
"modified": "2019-03-28T14:40:07.000Z",
|
|
"pattern": "[domain-name:value = 'o2.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdccf-0b50-4881-8bfe-4b34950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:15.000Z",
|
|
"modified": "2019-03-28T14:40:15.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'romanchukeyla@protonmail.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdcd0-3b78-4d12-b3c2-42ea950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:16.000Z",
|
|
"modified": "2019-03-28T14:40:16.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'couwetizotofo@o2.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdcd0-2d68-4958-8ea1-4cc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:16.000Z",
|
|
"modified": "2019-03-28T14:40:16.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'phanthavongsaneveyah@protonmail.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdcd0-4e7c-4567-a324-4a7d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:40:16.000Z",
|
|
"modified": "2019-03-28T14:40:16.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'aperywsqaroci@o2.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:40:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5c9e39dc-a38c-422e-903f-4831950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-29T15:29:32.000Z",
|
|
"modified": "2019-03-29T15:29:32.000Z",
|
|
"labels": [
|
|
"misp:type=\"pattern-in-file\"",
|
|
"misp:category=\"Artifacts dropped\""
|
|
],
|
|
"x_misp_category": "Artifacts dropped",
|
|
"x_misp_type": "pattern-in-file",
|
|
"x_misp_value": "javobohisabi yohoxucojanukazahaviwexepeniwa negikicudosoyihuruyadeyafipihaja\r\nTelawefibudi wuzahibe liga. Caku jakacoza zususezebonuli setusidafohi. Xekaho tiyiwifuvu damonixuxaho togubo\r\nxisLadoxuna pibifuzida. Goso sepudahemeli bu zevahilipezipa xurotocomupe. Kofe ridimarijoyane. Yeve.\r\nTuwipufebedopi yocomujiyezejo su su. Timevumavizase hapezo fogiju. Xonucosegogi li. Bobixayogaci. Kuyi. Leto\r\nzoyihebezobu wu ciwu. Docadufe ro judewocekodiki"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-0aa4-479e-80c5-457a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:10:25.000Z",
|
|
"modified": "2019-04-01T09:10:25.000Z",
|
|
"description": "C&C",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.210.136.65']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:10:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-97c8-4a64-aec2-46f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T06:40:41.000Z",
|
|
"modified": "2019-04-01T06:40:41.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.210.0.0/16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T06:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-b02c-43ad-afbd-4f69950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:11:07.000Z",
|
|
"modified": "2019-04-01T09:11:07.000Z",
|
|
"description": "C&C",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.91']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:11:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-01f8-4c66-b7a6-4318950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T06:40:41.000Z",
|
|
"modified": "2019-04-01T06:40:41.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.0/24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T06:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-6478-47f0-a5cd-4e8f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:11:00.000Z",
|
|
"modified": "2019-04-01T09:11:00.000Z",
|
|
"description": "C&C",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.202.174.86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:11:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-9670-48a3-8bbe-4639950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T06:40:41.000Z",
|
|
"modified": "2019-04-01T06:40:41.000Z",
|
|
"pattern": "[url:value = 'https://pastebin.com/raw/7Qmz6q5v']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T06:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-f7fc-4efd-9e26-4955950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:11:03.000Z",
|
|
"modified": "2019-04-01T09:11:03.000Z",
|
|
"description": "C&C",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.115.26.171']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:11:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b269-eb04-4df7-8a0b-41d9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T06:40:41.000Z",
|
|
"modified": "2019-04-01T06:40:41.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '93.115.26.0/24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T06:40:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1ce9d-cd4c-46b6-9a6a-3ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T08:41:01.000Z",
|
|
"modified": "2019-04-01T08:41:01.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.126.85.207']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T08:41:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1ce9d-b568-4caf-bdff-3ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T08:41:01.000Z",
|
|
"modified": "2019-04-01T08:41:01.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.126.85.0/24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T08:41:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-4e80-4388-9890-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.238.0.217']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-e228-4161-9aa7-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.105.158']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-f2a0-4fca-a92a-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.105.43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-69b8-4968-9f67-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.21']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-1654-4bf2-b765-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.88']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-3414-41ec-9f72-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.192.108.122']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-8b64-4abe-87e7-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.192.108.123']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-121c-4714-aa3e-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.186']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-a8d8-46e0-aa54-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-6ed8-400b-b4fa-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.168']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-d90c-47f7-94c8-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.185']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cb-27c4-4c61-a7ef-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:27.000Z",
|
|
"modified": "2019-04-01T09:24:27.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.184.134']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-5548-451c-9747-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.184.250']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-c67c-4701-8470-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.22']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-a450-4ef1-a1bb-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-f1c0-4dfc-85f9-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-5104-424c-bb78-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.46']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-2b0c-4ab6-9304-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.51']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-dc90-45a2-a6bf-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-fb50-48bc-8dbb-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-c190-4f11-9122-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.65']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-c2f0-469e-8883-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.77']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-0cd4-4431-a10f-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-6270-48ed-af05-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-dedc-4b55-ab68-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.70.187.92']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-3284-4bbd-a95a-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.118']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-589c-4067-adcd-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.77']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-ac04-4efc-a767-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-4df0-408a-8b83-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.44.84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-f428-494a-86ac-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.45.251']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-2d24-4de1-8232-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.207.45.45']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-c530-4ce4-9202-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.172']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-5c10-4070-aebe-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.183']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-55a0-4f8a-baf7-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.184']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-84f4-476c-8619-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.187']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1d8cc-4490-4918-ac84-d6af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:24:28.000Z",
|
|
"modified": "2019-04-01T09:24:28.000Z",
|
|
"description": "IP of server administration",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.188']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:24:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-87c0-4e54-891a-4dba950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '5286a5ed1288e7c54f1ca04d097f17c1d6aea32b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-c73c-48e1-91c2-4875950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '6dc00843f313690075612ee5ce770cae067cd37f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-a4c8-4094-be2e-4276950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'ee4c9567c9a072e1d8ed8a78cb06d6ce1a81dd11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-df5c-42e5-95c1-43ca950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2200eb3303e448a52404128458e87f3248d4612c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-2f08-4f8b-a82a-4d65950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.39.219.159']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-08fc-4585-83d4-47c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'f0e07b689caa5c7b3767bb3b4cfe4cba2aecb5f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-1960-4f42-89e3-4a5c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'cc9aa7e71ce04b893bcdf49a1da2f0e20e45faf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-5a98-4ee3-afa7-48c0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '840963454567b38a5f1d1df7cd202629804e4c61']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-9dc4-4403-aaaa-406e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.58.204.177']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-1610-4df6-9bd7-4a89950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'dc8f3c31906c01d077c614809bb1195af2393dc1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-0ebc-43d4-b476-48ea950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '02faf3e291435468607857694df5e45b68851868']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-aa0c-48ab-ac8e-4840950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '28a4481f8138c889367f9112ef48e4f17fb69944']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-fed8-4893-b9c4-4dc7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '339cdd57cfd5b141169b615ff31428782d1da639']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-e1c8-4d0d-8458-41eb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-72d0-49db-8909-4523950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '3712786dd9d1d8ac7db60ba2f989280c7257a3a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-7dfc-43c5-864b-494c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '736a4dc679d682da321563647c60f699f0dfc268']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-4b0c-4376-89e9-4075950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'b1bc968bd4f49d622aa89a81f2150152a41d829c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e082-c614-431c-b553-4eff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T09:57:22.000Z",
|
|
"modified": "2019-04-01T09:57:22.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '15abccaae3920046f55293e25f5f931a6581e00f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T09:57:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e719-4834-41f6-be6d-4586950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:29.000Z",
|
|
"modified": "2019-04-01T10:25:29.000Z",
|
|
"pattern": "[domain-name:value = 'scourketchupfries.cn.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e719-db18-46a6-9d1c-4acc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:29.000Z",
|
|
"modified": "2019-04-01T10:25:29.000Z",
|
|
"pattern": "[file:name = 'vds58339.localdomain']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e719-819c-451a-9977-400e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:29.000Z",
|
|
"modified": "2019-04-01T10:25:29.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'root@vds58339.localdomain']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e719-ffe4-4586-9f65-4c75950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:29.000Z",
|
|
"modified": "2019-04-01T10:25:29.000Z",
|
|
"pattern": "[file:name = 'localhost.localdomain']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e719-0af8-451f-9ab5-4828950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:29.000Z",
|
|
"modified": "2019-04-01T10:25:29.000Z",
|
|
"pattern": "[email-message:from_ref.value = 'root@localhost.localdomain']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"email-src\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e71a-e47c-45fa-95f8-4ebc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:30.000Z",
|
|
"modified": "2019-04-01T10:25:30.000Z",
|
|
"pattern": "[domain-name:value = 'www.csgolite.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e71a-eb68-4e2f-afb1-405c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:30.000Z",
|
|
"modified": "2019-04-01T10:25:30.000Z",
|
|
"pattern": "[domain-name:value = 'tcp.csgolite.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1e71a-4378-412c-acbe-499f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T10:25:30.000Z",
|
|
"modified": "2019-04-01T10:25:30.000Z",
|
|
"pattern": "[domain-name:value = 'bendermoney.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T10:25:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca21226-bc58-47e2-bc18-4c09950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T13:29:10.000Z",
|
|
"modified": "2019-04-01T13:29:10.000Z",
|
|
"pattern": "[url:value = 'https://pastebin.com/raw/wdcq0Tda']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T13:29:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca21226-ff2c-4002-91db-40b4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T13:29:10.000Z",
|
|
"modified": "2019-04-01T13:29:10.000Z",
|
|
"pattern": "[url:value = 'https://pastebin.com/raw/9ditgTZh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T13:29:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca21226-c4bc-43b0-b0da-40a8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-01T13:29:10.000Z",
|
|
"modified": "2019-04-01T13:29:10.000Z",
|
|
"pattern": "[url:value = 'https://pastebin.com/Mzd1HFrN']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-01T13:29:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca61559-4fd4-4df0-976e-43ba950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:31:53.000Z",
|
|
"modified": "2019-04-04T14:31:53.000Z",
|
|
"pattern": "[file:hashes.IMPHASH = 'c226ac4bab6f48634bacbb7a1d34f8f6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:31:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"imphash\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:46.000Z",
|
|
"modified": "2019-04-04T11:02:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '52340664fe59e030790c48b66924b5bd' AND file:hashes.SHA1 = '73171ffa6dfee5f9264e3d20a1b6926ec1b60897' AND file:hashes.SHA256 = 'bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9c882a-a40c-46db-a3f5-f383950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T08:39:06.000Z",
|
|
"modified": "2019-03-28T08:39:06.000Z",
|
|
"pattern": "[file:name = 'README-NOW.txt' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T08:39:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:46.000Z",
|
|
"modified": "2019-04-04T11:02:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '164f72dfb729ca1e15f99d456b7cf811' AND file:hashes.SHA1 = 'f92339e73c7e901c0c852d8e65615cfb588a4ff6' AND file:hashes.SHA256 = '8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:46.000Z",
|
|
"modified": "2019-04-04T11:02:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '9cad8641ac79688e09c5fa350aef2094' AND file:hashes.SHA1 = '3da0a217bbda09561780f52f163a6aafeb721d60' AND file:hashes.SHA256 = '5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:46.000Z",
|
|
"modified": "2019-04-04T11:02:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3ebca21b1d4e2f482b3eda6634e89211' AND file:hashes.SHA1 = '37cdd1e3225f8da596dc13779e902d8d13637360' AND file:hashes.SHA256 = '6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:46.000Z",
|
|
"modified": "2019-04-04T11:02:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a5bc1f94e7505a2e73c866551f7996f9' AND file:hashes.SHA1 = '7dea7ff735023418b902d093964028aefbc486a5' AND file:hashes.SHA256 = '14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a1d732aa27e1ca2ae45a189451419ed5' AND file:hashes.SHA1 = '50f5a5ec13d21d4df119140547d63bc40f93b079' AND file:hashes.SHA256 = 'c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'b3d3da12ca3b9efd042953caa6c3b8cd' AND file:hashes.SHA1 = '34fb03a35e723d27e99776ed3e81967229b3afe1' AND file:hashes.SHA256 = '7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'faf4de4e1c5d8e4241088c90cfe8eddd' AND file:hashes.SHA1 = 'fcd241fdcd462199f2907ca34c73ce9c89b03e5f' AND file:hashes.SHA256 = '47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9cdeef-4adc-461d-9b72-4062950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-03-28T14:49:19.000Z",
|
|
"modified": "2019-03-28T14:49:19.000Z",
|
|
"pattern": "[file:name = 'READ-ME-NOW.txt' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:parent_directory_ref.path = 'E:\\\\goga\\\\' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-03-28T14:49:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '174e3d9c7b0380dd7576187c715c4681' AND file:hashes.SHA1 = '31fbfe814628db3b459ddc87bf5ed538700db17a' AND file:hashes.SHA256 = 'c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a52f26575556d3c4eccd3b51265cb4e6' AND file:hashes.SHA1 = '61fdebb3c9dfa880b54e82579256acfcd4d6d406' AND file:hashes.SHA256 = '97a2ab7a94148d605f3c0a1146a70ba5c436a438b23298a1f02f71866f420c43' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ba53d8910ec3e46864c3c86ebd628796' AND file:hashes.SHA1 = 'd1c2dfedc602f5d5f2036b0ba5541cac8f8b4b95' AND file:hashes.SHA256 = 'a84171501074bac584348f2942964c8550374c39247ec6af0f4a69756ea9fc7a' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9e3b43-3128-4838-8d63-4a69950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '871aa15f4d61c85e1284e1be3f99f705' AND file:hashes.SHA1 = '236eac0b19f91117b27f1b198a4d8490d99ec2e5' AND file:hashes.SHA256 = 'b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '34187a34d0a3c5d63016c26346371b54' AND file:hashes.SHA1 = 'ce8209ff9828aa8cb095bd7d1589fc4d394c298c' AND file:hashes.SHA256 = '5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3' AND file:name = 'kill.bat' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '644087ccca16d2a728ef7685a4106f09' AND file:hashes.SHA1 = 'eabd6974ac71efd72d9e0688d5a6131f336d169c' AND file:hashes.SHA256 = '385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e' AND file:name = 'cob93.exe' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '7b792de1468a70cfe990b65034d5f3ac' AND file:hashes.SHA1 = '320f1fc66054e98681fd291415ff17b2e1a71b61' AND file:hashes.SHA256 = 'a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b' AND file:name = 'test.bat' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ca5e3be-9cc4-4a68-939e-bac6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:00:14.000Z",
|
|
"modified": "2019-04-04T11:00:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '06457b317d5624590803a77d3770bff2' AND file:name = 'AD.zip' AND file:name_enc = 'Adobe-Standard-Encoding' AND file:size = '472243' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:00:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:47.000Z",
|
|
"modified": "2019-04-04T11:02:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ecf535c505b7752b0af188a915a23786' AND file:hashes.SHA1 = '736a4dc679d682da321563647c60f699f0dfc268' AND file:hashes.SHA256 = 'bfdf4cf3f143ad0db912d8ab3a7c12f617b9ea60ce8b1f4e44f74270fb21b19b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-12-05 00:08:31",
|
|
"category": "Other",
|
|
"uuid": "a3fa831d-a38e-413e-bb19-1910b97fec2a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/bfdf4cf3f143ad0db912d8ab3a7c12f617b9ea60ce8b1f4e44f74270fb21b19b/analysis/1543968511/",
|
|
"category": "Payload delivery",
|
|
"uuid": "7ad826d7-4477-4290-9dd7-a0d29a060c1f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/58",
|
|
"category": "Payload delivery",
|
|
"uuid": "f0291f05-fdde-4969-8684-db393699dea4"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '83e10465b722ef33ff0b6f535e8d996b' AND file:hashes.SHA1 = '339cdd57cfd5b141169b615ff31428782d1da639' AND file:hashes.SHA256 = '02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-03 11:56:47",
|
|
"category": "Other",
|
|
"uuid": "f59d8322-50b5-4d3b-a2e4-eb219bcf694b"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/02ab57e4e67a0cb48dd2ff34830e8ac40f4476fb08ca6be3f5cd846f646840f0/analysis/1554292607/",
|
|
"category": "Payload delivery",
|
|
"uuid": "270cedd4-baf8-4281-b6fc-0f949fc211ca"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/58",
|
|
"category": "Payload delivery",
|
|
"uuid": "ebb52bad-6f2a-4b1b-a485-43be41a61f93"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1d3554048578b03f42424dbf20730a3f' AND file:hashes.SHA1 = '02faf3e291435468607857694df5e45b68851868' AND file:hashes.SHA256 = '687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-03-30 09:28:42",
|
|
"category": "Other",
|
|
"uuid": "3576524b-3254-41ac-ac75-478ebe162909"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2/analysis/1553938122/",
|
|
"category": "Payload delivery",
|
|
"uuid": "f5c8e926-2ac1-49ef-8bb4-6f237baaf112"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/58",
|
|
"category": "Payload delivery",
|
|
"uuid": "458c15ba-a1ca-4e47-8901-0500a4203afc"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1edaf9ae99ce2920667d0e9a8b3f8c9c' AND file:hashes.SHA1 = 'f5ad0bcc1ad56cd150725b1c866c30ad92ef21b0' AND file:hashes.SHA256 = '4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-03-20 15:20:14",
|
|
"category": "Other",
|
|
"uuid": "615d556b-f37c-400f-88e2-020eb673be6d"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/4f32d5dc00f715250abcc486511e37f501a899deb3bf7ea8adbbd3aef1c412da/analysis/1553095214/",
|
|
"category": "Payload delivery",
|
|
"uuid": "3b2c4cbb-41d9-4954-b0dd-4b6a52b87303"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/54",
|
|
"category": "Payload delivery",
|
|
"uuid": "8d33693b-a8e3-4c60-9df0-6bb18c7686e8"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:48.000Z",
|
|
"modified": "2019-04-04T11:02:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3e455215095192e1b75d379fb187298a' AND file:hashes.SHA1 = 'b1bc968bd4f49d622aa89a81f2150152a41d829c' AND file:hashes.SHA256 = 'ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T11:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-02-28 21:20:19",
|
|
"category": "Other",
|
|
"uuid": "a5771217-664e-468a-b883-963967688281"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99/analysis/1551388819/",
|
|
"category": "Payload delivery",
|
|
"uuid": "5c9d5e47-d971-4bd4-a0e2-55df09eb31f0"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/54",
|
|
"category": "Payload delivery",
|
|
"uuid": "9b3526d2-e054-419d-b3f6-b36588aa00fb"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:10:19",
|
|
"category": "Other",
|
|
"uuid": "c221b793-ca91-4ea5-9ba9-3a08b8d153b0"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29/analysis/1554361819/",
|
|
"category": "Payload delivery",
|
|
"uuid": "e62b032c-b748-43cf-9663-7bf43b7c811e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "49/68",
|
|
"category": "Payload delivery",
|
|
"uuid": "0903cfac-7124-4138-b7ca-350ccf89ef78"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-03 10:15:05",
|
|
"category": "Other",
|
|
"uuid": "95dd2a05-d5e2-4ca5-9b63-950965df87d7"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b/analysis/1554286505/",
|
|
"category": "Payload delivery",
|
|
"uuid": "92fa1fda-791f-4245-b42c-bf14fc0fb1d5"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "21/58",
|
|
"category": "Payload delivery",
|
|
"uuid": "9e9cd2ac-2699-4da9-befb-53651ad2aaa6"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-03 10:14:59",
|
|
"category": "Other",
|
|
"uuid": "8a4b82c6-9892-4c00-9855-b521648e574a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4/analysis/1554286499/",
|
|
"category": "Payload delivery",
|
|
"uuid": "c8a542e8-a2cb-4cf9-a070-d0b25ee49519"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "52/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "9263cb76-ef44-45ae-972c-fe3b90a4b2ff"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 06:54:10",
|
|
"category": "Other",
|
|
"uuid": "5871b620-bb9b-4dc1-ac8f-2f1c4e0840fd"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e/analysis/1554360850/",
|
|
"category": "Payload delivery",
|
|
"uuid": "1e73fc65-f7ce-4262-8463-0f80f93da9ae"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "53/70",
|
|
"category": "Payload delivery",
|
|
"uuid": "796a7fb7-65cf-4b5f-85a8-0a097520d3cb"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:24:59",
|
|
"category": "Other",
|
|
"uuid": "112fad1f-774e-4b50-8947-9657406c3627"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca/analysis/1554362699/",
|
|
"category": "Payload delivery",
|
|
"uuid": "8b0c280c-7c10-4b30-9fd0-4c073c4ea048"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "56/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "b138d431-1a16-4779-813e-b149a3421b4b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:49.000Z",
|
|
"modified": "2019-04-04T11:02:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 06:59:47",
|
|
"category": "Other",
|
|
"uuid": "96719cd4-a3be-42f9-9edd-7551a3d10efa"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3/analysis/1554361187/",
|
|
"category": "Payload delivery",
|
|
"uuid": "7f6155ce-dd15-474a-9b1e-b183b029e656"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "10/57",
|
|
"category": "Payload delivery",
|
|
"uuid": "33b779b8-ad32-4a69-8bbd-9fe21046e36b"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-01 16:37:44",
|
|
"category": "Other",
|
|
"uuid": "7d9c017b-8edd-49dd-ac87-83ede8411029"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/c7a69dcfb6a3fe433a52a71d85a7e90df25b1db1bc843a541eb08ea2fd1052a4/analysis/1554136664/",
|
|
"category": "Payload delivery",
|
|
"uuid": "e9bd4bc8-d8ec-4185-90ed-7e5786a6bce9"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "43/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "83263b7e-8059-46d2-8b99-5b0b43a37e90"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:05:59",
|
|
"category": "Other",
|
|
"uuid": "4553a71a-776c-4461-8a66-c7cd64e44318"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a/analysis/1554361559/",
|
|
"category": "Payload delivery",
|
|
"uuid": "da933654-16fb-498a-8640-44e69146f078"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "45/61",
|
|
"category": "Payload delivery",
|
|
"uuid": "a03d25eb-08d2-4ff8-87b8-e8f2c98eb179"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-02 23:51:08",
|
|
"category": "Other",
|
|
"uuid": "b5672881-9c3c-44f9-8db2-298d466a4dd9"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/97a2ab7a94148d605f3c0a1146a70ba5c436a438b23298a1f02f71866f420c43/analysis/1554249068/",
|
|
"category": "Payload delivery",
|
|
"uuid": "ed5167e6-ce8b-4816-888d-18b7cf9a9b4f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "44/72",
|
|
"category": "Payload delivery",
|
|
"uuid": "a4480342-e0bc-4292-bd67-5bcbe6369375"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-02 23:53:36",
|
|
"category": "Other",
|
|
"uuid": "19057350-70ca-4b61-bf3a-ccfe54f0490a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a84171501074bac584348f2942964c8550374c39247ec6af0f4a69756ea9fc7a/analysis/1554249216/",
|
|
"category": "Payload delivery",
|
|
"uuid": "021bca0d-21c1-4af3-ad1d-9ede46c96d73"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/68",
|
|
"category": "Payload delivery",
|
|
"uuid": "1d711364-ad24-4f60-a406-579fc420984f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:16:09",
|
|
"category": "Other",
|
|
"uuid": "a3ef3a8c-2c5b-469a-ba3a-232ea3d646b4"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c/analysis/1554362169/",
|
|
"category": "Payload delivery",
|
|
"uuid": "3431a2b3-15e0-4e7b-81e8-3a8a4467c58a"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "53/70",
|
|
"category": "Payload delivery",
|
|
"uuid": "2fd75f6e-a29d-4193-83af-07e23cc7565e"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-03 17:13:07",
|
|
"category": "Other",
|
|
"uuid": "101cf662-c46e-4335-8eef-189b488e4a31"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262/analysis/1554311587/",
|
|
"category": "Payload delivery",
|
|
"uuid": "15db5590-265b-4922-b1fd-352d2725bebc"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/66",
|
|
"category": "Payload delivery",
|
|
"uuid": "93ca72df-1be0-455f-a1cd-cf769e550da5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:50.000Z",
|
|
"modified": "2019-04-04T11:02:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:26:59",
|
|
"category": "Other",
|
|
"uuid": "0023fe73-0980-46e0-9556-46bbfe5fdec4"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125/analysis/1554362819/",
|
|
"category": "Payload delivery",
|
|
"uuid": "383e14be-cdda-4969-99ae-3adae2fa7b7f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/68",
|
|
"category": "Payload delivery",
|
|
"uuid": "ab2852d7-9aae-4a0f-aa4b-549583563ce7"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:21:45",
|
|
"category": "Other",
|
|
"uuid": "d4aea7f7-e340-4e76-89c1-2546884db901"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f/analysis/1554362505/",
|
|
"category": "Payload delivery",
|
|
"uuid": "bcc766b7-352e-4241-b3ba-4dab52c02065"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "55/70",
|
|
"category": "Payload delivery",
|
|
"uuid": "401b939c-ce2c-426b-9505-0554136fa85c"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-04-04 07:20:30",
|
|
"category": "Other",
|
|
"uuid": "29971556-1f8f-491a-bc22-607f26e0cdcf"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77/analysis/1554362430/",
|
|
"category": "Payload delivery",
|
|
"uuid": "088b3a1d-f7d5-4bf0-9998-7fa00b4d1177"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "55/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "de0d2c55-e16b-426a-95ef-f04995cada4f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--b6346b5e-5482-4314-9d7b-8671c4155bf1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:08:41.000Z",
|
|
"modified": "2019-04-04T14:08:41.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2a030cc6d84d5785f5e84d0f5888a411d4b06d01' AND file:name = 'soft.exe' AND file:size = '45568']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:08:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d74356f9-39d2-4c30-9711-8ed1a401acd3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:42.000Z",
|
|
"modified": "2019-04-04T14:11:42.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2abae839362edfe52d9ebe282fb61113d22b331f' AND file:name = 'sttager.exe' AND file:size = '20480']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e668ce8c-af43-4832-89b2-9c08e3f5124c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:42.000Z",
|
|
"modified": "2019-04-04T14:11:42.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '6995a32e0a4d4f6d0c9b2a00a96d69bff4b83ea7' AND file:name = 'test443.exe' AND file:size = '373911']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6e1a65fa-acb6-4ea6-a06b-636c428138b5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:43.000Z",
|
|
"modified": "2019-04-04T14:11:43.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '87b1f17fbb4a1e8eef4cb31c1c0194b1426c868c' AND file:name = 'veil.exe' AND file:size = '345761']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f7e26e48-37f4-45a8-8a1c-2ecc11dec53a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:43.000Z",
|
|
"modified": "2019-04-04T14:11:43.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'afc36916a4df934446681ea28bef6add4decb98a' AND file:name = '80_http.exe.exe' AND file:size = '411850']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d4db8abd-f691-4927-9e28-14ce0ee7d430",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:43.000Z",
|
|
"modified": "2019-04-04T14:11:43.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'f832d94391a8d2d5cf92773e6c912905ec7c40c7' AND file:name = 'test1.exe' AND file:size = '406636']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--3d49a49b-5bc6-49be-a0e6-ab3b72ccfe46",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:44.000Z",
|
|
"modified": "2019-04-04T14:11:44.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '056823c7891a04b2fec8903eb401ae3291743a54' AND file:name = 'beca.exe.exe' AND file:size = '23808']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f898f5e1-93e1-458b-996c-ebc6dba13222",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:44.000Z",
|
|
"modified": "2019-04-04T14:11:44.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'b7afa7acf1b7ded2c4e3d0884b5cdaa230d9f82e' AND file:name = 'shell1.exe' AND file:size = '24576']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--89b53bf3-e0c4-4f48-8e25-ff54844fae43",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:45.000Z",
|
|
"modified": "2019-04-04T14:11:45.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '4b50b6b9157026ab408d966ece02d1cef8045f82' AND file:name = 'starggge.exe' AND file:size = '27136']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--1162a78a-804d-4856-82b3-0b77509bcfe7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:45.000Z",
|
|
"modified": "2019-04-04T14:11:45.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '6042dfd50d33da40e383baec4a7ef7c75bf17481' AND file:name = '8_32.exe' AND file:size = '24064']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--bf5439e4-3e35-44a0-9ff3-129042947aad",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:45.000Z",
|
|
"modified": "2019-04-04T14:11:45.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '9b50fae63f4d8d402f30c487ca7216f610413642' AND file:name = 'payload.exe' AND file:size = '6144']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--02af3be3-4a7e-4a84-81eb-83f604a3f0a5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:46.000Z",
|
|
"modified": "2019-04-04T14:11:46.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '781778f789185889259d2a8dec981e80098fa490' AND file:name = '443_12.exe' AND file:size = '28904']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--dae97fa0-3eb3-4915-82cc-e7e489d64dd1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:46.000Z",
|
|
"modified": "2019-04-04T14:11:46.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '153d37f0f0660734a1e05cb67721c4ceff54919f' AND file:name = 'test.exe' AND file:size = '370807']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--24e6319c-f91c-43b2-a9d3-7b0bfd5a76a7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:47.000Z",
|
|
"modified": "2019-04-04T14:11:47.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2d038fcd5987b2e7008b2e269b0a9ff968063ee8' AND file:name = 'test_1.exe' AND file:size = '601039']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--3dac003b-a958-48e2-8a96-6d0fdba7875d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:47.000Z",
|
|
"modified": "2019-04-04T14:11:47.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '9d2148cd22c245fc3ba7861a560d223f72f34414' AND file:name = 'synack_network_noinject_x86.ps1' AND file:size = '302611']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c01e648d-7f49-45f7-b7d7-48ce5a507a47",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:48.000Z",
|
|
"modified": "2019-04-04T14:11:48.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'c8207144f89c9d775ff5565888dbbc8167e09330' AND file:name = 'synack_network_noinject_x64.ps1' AND file:size = '390311']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--ac91f1d9-024c-44e2-8a7c-06172796ea12",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:49.000Z",
|
|
"modified": "2019-04-04T14:11:49.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '5131a7a011041e88b32a2a98e5170c42d5c57250' AND file:name = 'synack_network_x64.ps1' AND file:size = '423995']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2ba4112d-7327-4b19-8035-a2e6eb73d573",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:50.000Z",
|
|
"modified": "2019-04-04T14:11:50.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'e925c3ba15f007363ad32b84df7da9b299b9b100' AND file:name = 'synack_x64.ps1' AND file:size = '423995']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7f430f07-3ff9-4553-b81a-36681949c447",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:51.000Z",
|
|
"modified": "2019-04-04T14:11:51.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '481b18bcbd9d32c5363bb56ab212d57d78497c05' AND file:name = 'synack_network_x86.ps1' AND file:size = '327187']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6fe2ec22-3ff6-4a79-af8e-30e6a5253e45",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:51.000Z",
|
|
"modified": "2019-04-04T14:11:51.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '2bcfd0679726f0110545b47b4512a8a4ddcb830f' AND file:name = 'synack_x86.ps1' AND file:size = '327187']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--b14e7307-30f6-49c8-b4fe-0b6735a3a94d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:52.000Z",
|
|
"modified": "2019-04-04T14:11:52.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'eaefb5e9ea2e0d301ee594e6358ea136442cd075' AND file:name = 'test.exe' AND file:size = '529477']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--3549d1ed-c1c7-4066-a9cc-9d0a86cd8e0a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:52.000Z",
|
|
"modified": "2019-04-04T14:11:52.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '237b19af7c867b21f46793dd7257dff2f3be1513' AND file:name = 'encryptor.zip' AND file:size = '18211']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--eaa8dc3c-16ef-45eb-add4-3d736d1bd330",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:52.000Z",
|
|
"modified": "2019-04-04T14:11:52.000Z",
|
|
"pattern": "[file:hashes.SHA1 = 'f5619064f2d8aebfdba0fc3f566cb60f599f9f6e' AND file:name = 'encryptor.exe' AND file:size = '29696']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7e91cd8c-c822-43fe-ac0b-5d137f57bc3a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:11:53.000Z",
|
|
"modified": "2019-04-04T14:11:53.000Z",
|
|
"pattern": "[file:hashes.SHA1 = '399d4d5ab0bdbe0b1a61bac007d56adff005486d' AND file:name = 'tung2901_AU3_EXE_6cr22.rar' AND file:size = '277412']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:11:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7b59d923-d374-41bc-89b7-e68498bacc72",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:34.000Z",
|
|
"modified": "2019-04-04T14:19:34.000Z",
|
|
"pattern": "[file:hashes.MD5 = '644087ccca16d2a728ef7685a4106f09' AND file:hashes.SHA1 = 'eabd6974ac71efd72d9e0688d5a6131f336d169c' AND file:hashes.SHA256 = '385e31c97e3a07bbb81513f0cd0979e64e6b014943902efd002f57b21eadd41e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--4b9fdc52-1ce3-45d7-85cc-60215eb30f0c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:34.000Z",
|
|
"modified": "2019-04-04T14:19:34.000Z",
|
|
"pattern": "[file:hashes.MD5 = '34187a34d0a3c5d63016c26346371b54' AND file:hashes.SHA1 = 'ce8209ff9828aa8cb095bd7d1589fc4d394c298c' AND file:hashes.SHA256 = '5f815b8a8e77731c9ca2b3a07a27f880ef24d54e458d77bdabbbaf2269fe96c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--fa63b93f-2201-4f6c-8341-4a86980805b3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:35.000Z",
|
|
"modified": "2019-04-04T14:19:35.000Z",
|
|
"pattern": "[file:hashes.MD5 = '871aa15f4d61c85e1284e1be3f99f705' AND file:hashes.SHA1 = '236eac0b19f91117b27f1b198a4d8490d99ec2e5' AND file:hashes.SHA256 = 'b434bccf0a5ff75b27184e661df751466aef69f35fbd7b8b8692302b8b886262']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c73504a4-60da-4107-adef-c10a0f52266b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:35.000Z",
|
|
"modified": "2019-04-04T14:19:35.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a1d732aa27e1ca2ae45a189451419ed5' AND file:hashes.SHA1 = '50f5a5ec13d21d4df119140547d63bc40f93b079' AND file:hashes.SHA256 = 'c3d334cb7f6007c9ebee1a68c4f3f72eac9b3c102461d39f2a0a4b32a053843a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--edbac896-cf24-4628-9064-7bac3c8e8d58",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:36.000Z",
|
|
"modified": "2019-04-04T14:19:36.000Z",
|
|
"pattern": "[file:hashes.MD5 = '164f72dfb729ca1e15f99d456b7cf811' AND file:hashes.SHA1 = 'f92339e73c7e901c0c852d8e65615cfb588a4ff6' AND file:hashes.SHA256 = '8cfbd38855d2d6033847142fdfa74710b796daf465ab94216fbbbe85971aee29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d91eacd1-efda-4eaf-ae5a-f815869b10dd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:36.000Z",
|
|
"modified": "2019-04-04T14:19:36.000Z",
|
|
"pattern": "[file:hashes.MD5 = '9cad8641ac79688e09c5fa350aef2094' AND file:hashes.SHA1 = '3da0a217bbda09561780f52f163a6aafeb721d60' AND file:hashes.SHA256 = '5b0b972713cd8611b04e4673676cdff70345ac7301b2c23173cdfeaff564225c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a1a25873-3445-4873-8b6b-7dca2e15615a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:36.000Z",
|
|
"modified": "2019-04-04T14:19:36.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3ebca21b1d4e2f482b3eda6634e89211' AND file:hashes.SHA1 = '37cdd1e3225f8da596dc13779e902d8d13637360' AND file:hashes.SHA256 = '6e69548b1ae61d951452b65db15716a5ee2f9373be05011e897c61118c239a77']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--9aa33ad7-9f08-4774-b109-cedaed81cd60",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:37.000Z",
|
|
"modified": "2019-04-04T14:19:37.000Z",
|
|
"pattern": "[file:hashes.MD5 = '52340664fe59e030790c48b66924b5bd' AND file:hashes.SHA1 = '73171ffa6dfee5f9264e3d20a1b6926ec1b60897' AND file:hashes.SHA256 = 'bdf36127817413f625d2625d3133760af724d6ad2410bea7297ddc116abc268f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--dc691061-1ee8-46b1-b3ef-488f082e45c8",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:38.000Z",
|
|
"modified": "2019-04-04T14:19:38.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a5bc1f94e7505a2e73c866551f7996f9' AND file:hashes.SHA1 = '7dea7ff735023418b902d093964028aefbc486a5' AND file:hashes.SHA256 = '14e8a8095426245633cd6c3440afc5b29d0c8cd4acefd10e16f82eb3295077ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--8d31887c-d4a7-4e7f-899c-df1d3a41e15f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:38.000Z",
|
|
"modified": "2019-04-04T14:19:38.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'b3d3da12ca3b9efd042953caa6c3b8cd' AND file:hashes.SHA1 = '34fb03a35e723d27e99776ed3e81967229b3afe1' AND file:hashes.SHA256 = '7852b47e7a9e3f792755395584c64dd81b68ab3cbcdf82f60e50dc5fa7385125']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--febd2cf8-35c9-49d2-9963-21b43acb6f04",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:39.000Z",
|
|
"modified": "2019-04-04T14:19:39.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'faf4de4e1c5d8e4241088c90cfe8eddd' AND file:hashes.SHA1 = 'fcd241fdcd462199f2907ca34c73ce9c89b03e5f' AND file:hashes.SHA256 = '47f5a231f7cd0e36508ca6ff8c21c08a7248f0f2bd79c1e772b73443597b09b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f63b62d9-f5f1-4c51-9488-139d016e7660",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2019-04-04T14:19:39.000Z",
|
|
"modified": "2019-04-04T14:19:39.000Z",
|
|
"pattern": "[file:hashes.MD5 = '7b792de1468a70cfe990b65034d5f3ac' AND file:hashes.SHA1 = '320f1fc66054e98681fd291415ff17b2e1a71b61' AND file:hashes.SHA256 = 'a89eac79ff230f3c270b465cd2d8c1225b8937bd4b069ac27872ac883082d82b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2019-04-04T14:19:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--befab1a1-2b4a-4540-952a-922278cf82c0",
|
|
"created": "2019-03-28T08:39:21.000Z",
|
|
"modified": "2019-03-28T08:39:21.000Z",
|
|
"relationship_type": "creator-of",
|
|
"source_ref": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f",
|
|
"target_ref": "indicator--5c9c882a-a40c-46db-a3f5-f383950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d6c71559-29b0-48dd-9236-20c9f79ac1e1",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9c866a-b3b4-41e8-9594-f646950d210f",
|
|
"target_ref": "x-misp-object--3ba890fa-43c6-4805-a7ab-2fba74c0ced0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9aad7daf-6c59-4867-ba46-3232293ee3a8",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cb1a2-817c-414b-b7be-43cd950d210f",
|
|
"target_ref": "x-misp-object--83d90e56-d8fd-4fb2-bb57-580a66a57ee2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--724f2840-888d-4639-85c8-a1eca39cc5ca",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cb1c2-6f04-4808-99d0-4d8f950d210f",
|
|
"target_ref": "x-misp-object--c4efd0bd-ca37-4e9a-9669-b284391231d0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0a6c6598-6f22-4d03-af41-5e2cdf61caae",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cb1dc-7ee8-4a94-adef-41cb950d210f",
|
|
"target_ref": "x-misp-object--c186be47-3752-42e1-89d5-1e5b3d5223de"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9af6cf96-af83-44ac-81a6-f8fbbcd8ce22",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cb2c5-c444-4380-9cd7-4c8a950d210f",
|
|
"target_ref": "x-misp-object--aa4a78fa-47d0-4ec6-bcb8-1ff43d2e612d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a0a026c0-bd52-480a-9e06-184b87fccd01",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cdbf4-ea34-4d13-90a4-4ce6950d210f",
|
|
"target_ref": "x-misp-object--90999cf4-f049-48cc-b058-7218d5e66a87"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b82b8365-592c-429b-b8be-8b675cf76c24",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cdc5e-12f4-4dfc-9918-4108950d210f",
|
|
"target_ref": "x-misp-object--4a8c1dc6-773d-4883-be6f-8c7008a56ba7"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c8739605-5978-45e9-bdee-187564723288",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9cdc7d-4d18-4cc8-b36e-4c83950d210f",
|
|
"target_ref": "x-misp-object--62d88faa-c81c-4ee2-a031-950e7b8e74eb"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--20d02435-b817-4bf1-9c03-bddbd24b0212",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9e3862-4960-4ec0-a6fc-4f4e950d210f",
|
|
"target_ref": "x-misp-object--5e8bc41a-f1de-4db9-99ce-f8e2d360a71e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--419f5108-66d9-4623-b8a6-0d56789b4d9f",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9e3895-b9dc-4d74-baa0-4e3e950d210f",
|
|
"target_ref": "x-misp-object--6ec3241c-a53a-4b24-ad19-b37fe1926ca3"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--96177536-f8e7-4ffb-8771-69feda28cc02",
|
|
"created": "2019-04-04T11:02:51.000Z",
|
|
"modified": "2019-04-04T11:02:51.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9e38d2-e5ac-42e6-8787-4c7a950d210f",
|
|
"target_ref": "x-misp-object--0bc1a3db-aa59-4e3e-962c-0141a9507044"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f9305cde-1e4d-45bd-a0ca-cc4176c807fb",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9e3b43-3128-4838-8d63-4a69950d210f",
|
|
"target_ref": "x-misp-object--91238841-2e89-4fd8-a8e8-eda64827b73d"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9afb5fff-3b1d-42e8-9c36-9c612422b106",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5c9e3bc2-5a24-4d69-a335-4793950d210f",
|
|
"target_ref": "x-misp-object--dff728c7-5c19-4f03-86c3-da8de2fb5fe9"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cd469e0b-49ca-4af6-8603-4f2297e9cc79",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5ca1b7ca-7424-4d99-8c46-4095950d210f",
|
|
"target_ref": "x-misp-object--655b355a-d27a-47e7-953c-e518814e77d1"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9304643c-6881-41e3-9198-04c65d84152b",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--5ca1ce80-3410-445c-9a8c-20d7950d210f",
|
|
"target_ref": "x-misp-object--15d2637f-5587-422e-9c0d-b5765db3b370"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1a430efa-100e-405b-8264-4b85ee5665dc",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f9ccc29b-21e0-4670-bd40-9ddb5e77097a",
|
|
"target_ref": "x-misp-object--35c21dc1-1c39-413c-946a-f8bb9b26b6f7"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4b98aec3-9c78-4ac5-aee1-24e43314c48f",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--72d7def0-5a71-4c2c-b37c-4a3e4e8b12a1",
|
|
"target_ref": "x-misp-object--5108ef6e-6e11-42eb-b04b-c98a3baf0989"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d5fa14a8-ad21-4a78-8857-f209ef41a16a",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f267dc71-bbf0-4cc5-9b5b-3fa211e28a18",
|
|
"target_ref": "x-misp-object--f0ef8684-416a-4769-ad67-0b01c27351f8"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--215abfc9-1d9c-482b-9b7e-0439fb0c579f",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--aea6e39a-79e2-459d-bcc5-4a1ea6a2a033",
|
|
"target_ref": "x-misp-object--9d450a87-d02c-4ca7-8e63-51de5717eac9"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--948a3baa-9eed-495e-8bb6-aa62dd820348",
|
|
"created": "2019-04-04T11:02:52.000Z",
|
|
"modified": "2019-04-04T11:02:52.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--a1a98fae-2b40-4d36-bd5c-5b601c2ca216",
|
|
"target_ref": "x-misp-object--e3d0d58a-ba39-4023-9f87-abc23fee99ab"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |