adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5cd01261-afe0-4ce0-b11a-45f9950d210f.json

250 lines
No EOL
11 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5cd01261-afe0-4ce0-b11a-45f9950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-07T06:22:26.000Z",
"modified": "2019-05-07T06:22:26.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "grouping",
"spec_version": "2.1",
"id": "grouping--5cd01261-afe0-4ce0-b11a-45f9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-07T06:22:26.000Z",
"modified": "2019-05-07T06:22:26.000Z",
"name": "OSINT - Mystery Git ransomware appears to blank commits, demands Bitcoin to rescue code",
"context": "suspicious-activity",
"object_refs": [
"observed-data--5cd023ae-1230-4bf2-810a-9a7b950d210f",
"url--5cd023ae-1230-4bf2-810a-9a7b950d210f",
"observed-data--5cd023ae-72c0-4b5c-9ba6-9a7b950d210f",
"url--5cd023ae-72c0-4b5c-9ba6-9a7b950d210f",
"observed-data--5cd023ae-a600-46e5-b1b9-9a7b950d210f",
"url--5cd023ae-a600-46e5-b1b9-9a7b950d210f",
"observed-data--5cd023ae-f948-45bf-8d88-9a7b950d210f",
"url--5cd023ae-f948-45bf-8d88-9a7b950d210f",
"observed-data--5cd023ae-6f54-4d56-ac08-9a7b950d210f",
"url--5cd023ae-6f54-4d56-ac08-9a7b950d210f",
"indicator--5cd0253b-cc70-40ec-bb1c-bdd1950d210f",
"x-misp-attribute--5cd0268d-a704-4d9b-99df-cbbf950d210f",
"x-misp-object--5cd02519-04f4-4ea7-9e04-d279950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"malware_classification:malware-category=\"Ransomware\"",
"osint:source-type=\"blog-post\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd023ae-1230-4bf2-810a-9a7b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:08:14.000Z",
"modified": "2019-05-06T12:08:14.000Z",
"first_observed": "2019-05-06T12:08:14Z",
"last_observed": "2019-05-06T12:08:14Z",
"number_observed": 1,
"object_refs": [
"url--5cd023ae-1230-4bf2-810a-9a7b950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd023ae-1230-4bf2-810a-9a7b950d210f",
"value": "https://brica.de/alerts/alert/public/1257622/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd023ae-72c0-4b5c-9ba6-9a7b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:08:14.000Z",
"modified": "2019-05-06T12:08:14.000Z",
"first_observed": "2019-05-06T12:08:14Z",
"last_observed": "2019-05-06T12:08:14Z",
"number_observed": 1,
"object_refs": [
"url--5cd023ae-72c0-4b5c-9ba6-9a7b950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd023ae-72c0-4b5c-9ba6-9a7b950d210f",
"value": "https://www.theregister.co.uk/AMP/2019/05/03/git_ransomware_bitcoin/?utm_source=share&utm_medium=ios_app"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd023ae-a600-46e5-b1b9-9a7b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:08:14.000Z",
"modified": "2019-05-06T12:08:14.000Z",
"first_observed": "2019-05-06T12:08:14Z",
"last_observed": "2019-05-06T12:08:14Z",
"number_observed": 1,
"object_refs": [
"url--5cd023ae-a600-46e5-b1b9-9a7b950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd023ae-a600-46e5-b1b9-9a7b950d210f",
"value": "https://security.stackexchange.com/questions/209448/gitlab-account-hacked-and-repo-wiped"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd023ae-f948-45bf-8d88-9a7b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:08:14.000Z",
"modified": "2019-05-06T12:08:14.000Z",
"first_observed": "2019-05-06T12:08:14Z",
"last_observed": "2019-05-06T12:08:14Z",
"number_observed": 1,
"object_refs": [
"url--5cd023ae-f948-45bf-8d88-9a7b950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd023ae-f948-45bf-8d88-9a7b950d210f",
"value": "https://au.pcmag.com/news-1/61982/hacker-tries-to-ransom-github-code-repositories-for-bitcoin"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5cd023ae-6f54-4d56-ac08-9a7b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:08:14.000Z",
"modified": "2019-05-06T12:08:14.000Z",
"first_observed": "2019-05-06T12:08:14Z",
"last_observed": "2019-05-06T12:08:14Z",
"number_observed": 1,
"object_refs": [
"url--5cd023ae-6f54-4d56-ac08-9a7b950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5cd023ae-6f54-4d56-ac08-9a7b950d210f",
"value": "https://www.zdnet.com/article/a-hacker-is-wiping-git-repositories-and-asking-for-a-ransom/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5cd0253b-cc70-40ec-bb1c-bdd1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:14:51.000Z",
"modified": "2019-05-06T12:14:51.000Z",
"pattern": "[email-message:from_ref.value = 'admin@gitsbackup.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-05-06T12:14:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"email-src\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5cd0268d-a704-4d9b-99df-cbbf950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:20:29.000Z",
"modified": "2019-05-06T12:20:29.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Artifacts dropped\""
],
"x_misp_category": "Artifacts dropped",
"x_misp_comment": "Ransomnote",
"x_misp_type": "text",
"x_misp_value": "To recover your lost code and avoid leaking it: Send us 0.1 Bitcoin (BTC) to our Bitcoin address 1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA and contact us by Email at admin@gitsbackup.com with your Git login and a Proof of Payment. If you are unsure if we have your data, contact us and we will send you a proof. Your code is downloaded and backed up on our servers. If we dont receive your payment in the next 10 Days, we will make your code public or use them otherwise."
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--5cd02519-04f4-4ea7-9e04-d279950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2019-05-06T12:14:17.000Z",
"modified": "2019-05-06T12:14:17.000Z",
"labels": [
"misp:name=\"coin-address\"",
"misp:meta-category=\"financial\""
],
"x_misp_attributes": [
{
"type": "btc",
"object_relation": "address",
"value": "1ES14c7qLb5CYhLMUekctxLgc1FV2Ti9DA",
"category": "Financial fraud",
"to_ids": true,
"uuid": "5cd02519-af18-485c-9492-d279950d210f"
},
{
"type": "text",
"object_relation": "symbol",
"value": "BTC",
"category": "Other",
"uuid": "5cd02519-d1ac-4e5b-83d4-d279950d210f"
}
],
"x_misp_meta_category": "financial",
"x_misp_name": "coin-address"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink