23603 lines
No EOL
1,004 KiB
JSON
23603 lines
No EOL
1,004 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--58e7464f-8a5c-44bf-b478-4448950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T12:21:18.000Z",
|
|
"modified": "2017-04-07T12:21:18.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--58e7464f-8a5c-44bf-b478-4448950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T12:21:18.000Z",
|
|
"modified": "2017-04-07T12:21:18.000Z",
|
|
"name": "OSINT - Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA",
|
|
"published": "2017-04-07T12:21:45Z",
|
|
"object_refs": [
|
|
"observed-data--58e7465c-2958-4e50-aacb-44a5950d210f",
|
|
"url--58e7465c-2958-4e50-aacb-44a5950d210f",
|
|
"x-misp-attribute--58e74b45-3bd0-4dda-8a12-49b2950d210f",
|
|
"indicator--58e74c05-e500-4342-88f0-43b4950d210f",
|
|
"indicator--58e74c06-fa24-4339-abd8-4fd2950d210f",
|
|
"indicator--58e74fd3-6748-4dcb-9cc3-440a950d210f",
|
|
"indicator--58e750ac-2470-41aa-b3aa-4a80950d210f",
|
|
"indicator--58e75106-c1a8-452e-940c-4e18950d210f",
|
|
"indicator--58e7516d-17e4-41f2-bb98-4d58950d210f",
|
|
"indicator--58e7516e-0548-438c-9833-495d950d210f",
|
|
"indicator--58e7516f-7160-4c8d-9719-4d89950d210f",
|
|
"indicator--58e7563f-6330-4989-a699-4b16950d210f",
|
|
"indicator--58e756dc-64fc-4c88-a32c-4215950d210f",
|
|
"indicator--58e756dd-5b4c-44db-9b97-4baf950d210f",
|
|
"indicator--58e756de-d604-4397-9a58-4def950d210f",
|
|
"indicator--58e756df-cc0c-4b44-9b10-4485950d210f",
|
|
"indicator--58e756e0-fee8-4b0c-a8e0-4a5e950d210f",
|
|
"indicator--58e756e1-cd98-435f-8c5e-4806950d210f",
|
|
"indicator--58e756e2-2e74-4165-9c49-4539950d210f",
|
|
"indicator--58e756e3-b480-4e30-b17d-43f6950d210f",
|
|
"indicator--58e756e3-95d8-40d3-82f2-4435950d210f",
|
|
"indicator--58e756e4-28a4-4874-bffd-43dd950d210f",
|
|
"indicator--58e756e5-bb54-4684-86af-4ebd950d210f",
|
|
"indicator--58e756e6-3674-46e0-8a33-4cdc950d210f",
|
|
"indicator--58e756e7-245c-44a2-a34a-4f7b950d210f",
|
|
"indicator--58e756e8-5ea4-44fe-9773-48eb950d210f",
|
|
"indicator--58e756e9-953c-41c3-a848-488e950d210f",
|
|
"indicator--58e756ea-ef2c-464e-9238-4d6d950d210f",
|
|
"indicator--58e756ea-a848-4ca1-b8e7-406d950d210f",
|
|
"indicator--58e756eb-9dfc-4b74-bd16-4c6e950d210f",
|
|
"indicator--58e756ec-7824-48e8-b9fe-4f88950d210f",
|
|
"indicator--58e756ed-d7f0-497e-b745-421c950d210f",
|
|
"indicator--58e756ef-5450-4ebc-896d-4776950d210f",
|
|
"indicator--58e756ef-3c50-4042-8d13-40ac950d210f",
|
|
"indicator--58e756f0-28d4-48d2-b6c5-4c8a950d210f",
|
|
"indicator--58e756f1-79f8-456d-920f-49cd950d210f",
|
|
"indicator--58e756f2-7e30-411f-93d4-4c0b950d210f",
|
|
"indicator--58e756f3-31b8-477f-82ad-4954950d210f",
|
|
"indicator--58e756f4-0a58-4d73-89f0-4eba950d210f",
|
|
"indicator--58e756f5-c3d4-4973-b25a-45f9950d210f",
|
|
"indicator--58e756f6-cac4-4b9e-b36a-4765950d210f",
|
|
"indicator--58e756f7-3fa0-45b6-8607-432d950d210f",
|
|
"indicator--58e756f8-8958-4ffa-bb88-4556950d210f",
|
|
"indicator--58e756f9-34ac-4946-8bb2-4c30950d210f",
|
|
"indicator--58e756fa-5c5c-45f8-bc6f-46e3950d210f",
|
|
"indicator--58e756fb-2cbc-4ac1-b3fd-43cf950d210f",
|
|
"indicator--58e756fc-84d0-49a5-80ec-47b6950d210f",
|
|
"indicator--58e756fd-c74c-455e-9dc3-46d4950d210f",
|
|
"indicator--58e756fe-47b8-4250-a1cb-44c3950d210f",
|
|
"indicator--58e756ff-10a8-4d92-acba-4295950d210f",
|
|
"indicator--58e75700-8954-4563-b33a-4de0950d210f",
|
|
"indicator--58e75701-ee4c-41bf-8291-457e950d210f",
|
|
"indicator--58e75702-88bc-49ad-92ec-44af950d210f",
|
|
"indicator--58e75702-23c4-47bb-9888-4681950d210f",
|
|
"indicator--58e75703-f70c-478a-8c93-4cd8950d210f",
|
|
"indicator--58e75704-f48c-4d9f-91f8-4366950d210f",
|
|
"indicator--58e759a7-b298-45b5-9b5c-41b7950d210f",
|
|
"indicator--58e759a8-9a1c-4078-818d-42a8950d210f",
|
|
"indicator--58e759a9-e4fc-4213-a213-4dca950d210f",
|
|
"indicator--58e759aa-9020-4ac7-8a6d-4510950d210f",
|
|
"indicator--58e759aa-ddd4-49b2-ad56-4bb8950d210f",
|
|
"indicator--58e759ab-10d4-4c8a-b492-4461950d210f",
|
|
"indicator--58e759ac-be28-4683-a838-4750950d210f",
|
|
"indicator--58e759ad-e874-4f0c-9caa-43b5950d210f",
|
|
"indicator--58e759ae-22e8-49a1-b8b8-4cd5950d210f",
|
|
"indicator--58e759af-7da0-441f-bb77-4075950d210f",
|
|
"indicator--58e759b0-4290-4848-84f5-4b2e950d210f",
|
|
"indicator--58e759b1-1b8c-4d02-b7af-471c950d210f",
|
|
"indicator--58e759b2-5b48-4f94-8614-4cc4950d210f",
|
|
"indicator--58e759b3-84a4-417e-bf51-4c2c950d210f",
|
|
"indicator--58e759b4-ec1c-4a20-9983-4f57950d210f",
|
|
"indicator--58e759b5-47d4-48e7-811e-4306950d210f",
|
|
"indicator--58e759b6-cef8-485c-bf41-477b950d210f",
|
|
"indicator--58e759b7-7f38-42fc-a395-432a950d210f",
|
|
"indicator--58e759b8-f6b4-4376-b698-4ccd950d210f",
|
|
"indicator--58e759b9-c440-4982-9293-40e2950d210f",
|
|
"indicator--58e759ba-e294-4697-8ab8-4b4e950d210f",
|
|
"indicator--58e759ba-c1f4-4a1f-8cfc-4eb0950d210f",
|
|
"indicator--58e759bb-aaa8-4b4c-a225-46ac950d210f",
|
|
"indicator--58e759bc-a630-4d46-9757-482e950d210f",
|
|
"indicator--58e759bd-8568-43fe-a929-48df950d210f",
|
|
"indicator--58e759be-ca64-4063-860d-419d950d210f",
|
|
"indicator--58e759bf-59bc-4dcf-8e0b-4776950d210f",
|
|
"indicator--58e759c0-8460-4673-b15b-4535950d210f",
|
|
"indicator--58e759c1-36e8-4145-a947-4203950d210f",
|
|
"indicator--58e759c2-5c20-428a-9654-4b1d950d210f",
|
|
"indicator--58e759c3-fa88-4376-b240-4b05950d210f",
|
|
"indicator--58e759c4-8694-4754-99e9-4585950d210f",
|
|
"indicator--58e759c5-8c5c-474a-a1a2-44ad950d210f",
|
|
"indicator--58e759c6-d42c-40dd-a004-41a7950d210f",
|
|
"indicator--58e759c6-a204-4aa8-ae75-44f3950d210f",
|
|
"indicator--58e759c7-0a74-4a43-ac3f-413f950d210f",
|
|
"indicator--58e759c8-67c0-47c0-86a3-4f6f950d210f",
|
|
"indicator--58e759c9-7668-4547-92d7-430e950d210f",
|
|
"indicator--58e759ca-a0f0-465b-af28-4ca3950d210f",
|
|
"indicator--58e759cb-f158-4f92-a9f3-4a40950d210f",
|
|
"indicator--58e759cc-58fc-4e75-b4dc-4973950d210f",
|
|
"indicator--58e759cd-456c-4a80-a4cb-4253950d210f",
|
|
"indicator--58e759ce-35c4-4ccd-9a9f-481c950d210f",
|
|
"indicator--58e759cf-4d28-4a22-a5ef-4b31950d210f",
|
|
"indicator--58e759d0-7e68-4a23-8be7-4260950d210f",
|
|
"indicator--58e759d1-a3dc-450c-ba01-43c7950d210f",
|
|
"indicator--58e759d2-0ccc-4411-8392-4927950d210f",
|
|
"indicator--58e759d2-7cd4-47d4-b112-4302950d210f",
|
|
"indicator--58e759d3-e168-4c09-8e2c-40f4950d210f",
|
|
"indicator--58e759d4-efcc-4b29-b0c2-4ef4950d210f",
|
|
"indicator--58e759d5-4378-4cfb-9bb3-4650950d210f",
|
|
"indicator--58e759d6-3604-4945-8313-4062950d210f",
|
|
"indicator--58e759d7-93d0-48ba-86aa-448e950d210f",
|
|
"indicator--58e759d8-ddf8-4008-b5c8-43be950d210f",
|
|
"indicator--58e759d9-57f4-4a7b-8f8c-4758950d210f",
|
|
"indicator--58e759da-7274-4077-b3fe-493a950d210f",
|
|
"indicator--58e759db-89a8-47c9-b35c-4eb4950d210f",
|
|
"indicator--58e759dc-c3b4-4416-a743-4021950d210f",
|
|
"indicator--58e759dd-010c-4948-a8bd-444d950d210f",
|
|
"indicator--58e759dd-3e14-408f-ad0e-4757950d210f",
|
|
"indicator--58e759de-ffc0-4206-82f3-44d8950d210f",
|
|
"indicator--58e759df-b520-4fd6-a9a0-4f6b950d210f",
|
|
"indicator--58e759e0-c1c4-4aec-8c5d-4e4b950d210f",
|
|
"indicator--58e759e1-a548-416f-bd08-4209950d210f",
|
|
"indicator--58e759e2-d204-4f67-97c3-4169950d210f",
|
|
"indicator--58e759e3-a76c-4de3-97c6-49c5950d210f",
|
|
"indicator--58e759e4-5838-4f5f-a6b0-43d8950d210f",
|
|
"indicator--58e759e5-b2b0-4da8-9a3e-447a950d210f",
|
|
"indicator--58e759e6-c438-4ac8-a7b9-419d950d210f",
|
|
"indicator--58e759e7-237c-4134-a03f-4c61950d210f",
|
|
"indicator--58e759e8-4018-4b6d-a2ab-4f3d950d210f",
|
|
"indicator--58e759e9-3108-441b-881e-41ec950d210f",
|
|
"indicator--58e759e9-11f4-4399-8810-40f1950d210f",
|
|
"indicator--58e759ea-99c0-41b9-b0c9-4590950d210f",
|
|
"indicator--58e759eb-b910-46e3-b9c2-4a6d950d210f",
|
|
"indicator--58e759ec-7674-4004-b5fb-4f5a950d210f",
|
|
"indicator--58e759ed-a5ec-4b83-bed2-4b2e950d210f",
|
|
"indicator--58e759ee-2298-404d-a19f-4cc5950d210f",
|
|
"indicator--58e759ef-f5a8-4c4e-88e9-4d51950d210f",
|
|
"indicator--58e759f0-0cc4-4a7c-9e0b-4efa950d210f",
|
|
"indicator--58e759f1-2298-4851-9596-46af950d210f",
|
|
"indicator--58e759f2-faf4-4d30-a0e3-44ae950d210f",
|
|
"indicator--58e759f3-0014-4c8f-bfef-49a5950d210f",
|
|
"indicator--58e759f4-b470-48f0-9f2b-4772950d210f",
|
|
"indicator--58e759f4-97b4-4208-ae60-4252950d210f",
|
|
"indicator--58e759f5-a9f0-4ef6-9cd6-42fe950d210f",
|
|
"indicator--58e759f6-0a60-44ce-a8ef-445f950d210f",
|
|
"indicator--58e759f7-7868-400d-b07e-4f25950d210f",
|
|
"indicator--58e759f8-3a54-4fce-b8f6-481d950d210f",
|
|
"indicator--58e759f9-85f8-4c19-8dd6-47d7950d210f",
|
|
"indicator--58e759fa-efcc-447b-87f4-4320950d210f",
|
|
"indicator--58e759fb-f854-4113-b826-4667950d210f",
|
|
"indicator--58e759fc-3028-4780-b96d-4ecb950d210f",
|
|
"indicator--58e759fd-0c14-4251-bf3c-4477950d210f",
|
|
"indicator--58e759fe-7b1c-4750-9003-41c7950d210f",
|
|
"indicator--58e759ff-41e8-4537-b9e2-4323950d210f",
|
|
"indicator--58e759ff-5404-4587-998c-402c950d210f",
|
|
"indicator--58e75a00-f49c-45e8-aa05-4ea9950d210f",
|
|
"indicator--58e75a01-cf40-4e46-9862-4db2950d210f",
|
|
"indicator--58e75a02-85d4-4873-ac76-4f56950d210f",
|
|
"indicator--58e75a03-3b74-488c-98fc-406f950d210f",
|
|
"indicator--58e75a04-acd4-482e-9d43-4d18950d210f",
|
|
"indicator--58e75a05-6e64-43fc-acae-436a950d210f",
|
|
"indicator--58e75a06-b7d0-4e04-bc9d-4770950d210f",
|
|
"indicator--58e75a07-4314-42a3-8938-4fb3950d210f",
|
|
"indicator--58e75a08-a0ac-4b23-ae53-42f6950d210f",
|
|
"indicator--58e75a09-1ea0-4924-bcd9-487c950d210f",
|
|
"indicator--58e75a0a-c0a8-4677-a150-4322950d210f",
|
|
"indicator--58e75a0b-3948-49ad-87e4-43c1950d210f",
|
|
"indicator--58e75a0b-d5cc-4cee-bb16-48bc950d210f",
|
|
"indicator--58e75c77-4a74-4316-b048-4d1b950d210f",
|
|
"indicator--58e75c78-1964-476c-a97b-4ce3950d210f",
|
|
"indicator--58e75c79-0748-4325-9a3e-4372950d210f",
|
|
"indicator--58e75c7a-b30c-4268-a943-4453950d210f",
|
|
"indicator--58e75c7b-12b4-4e1b-99fa-4bdd950d210f",
|
|
"indicator--58e75c7c-8294-414a-9bd8-4c5e950d210f",
|
|
"indicator--58e75c7d-da6c-4611-98f2-4822950d210f",
|
|
"indicator--58e75c7e-b1f4-4cc4-8ab9-4123950d210f",
|
|
"indicator--58e75c7f-c4e0-4d46-993f-4e7f950d210f",
|
|
"indicator--58e75c80-ed44-43d7-be6e-43b9950d210f",
|
|
"indicator--58e75c81-6eb0-4558-8e0e-4561950d210f",
|
|
"indicator--58e75c82-3760-4bae-8563-4543950d210f",
|
|
"indicator--58e75c83-ff80-4120-9469-4b88950d210f",
|
|
"indicator--58e75c84-cd18-47b5-913b-4c13950d210f",
|
|
"indicator--58e75c85-6e80-428e-a1e7-49e8950d210f",
|
|
"indicator--58e75c86-fbdc-4e8f-b415-4dd7950d210f",
|
|
"indicator--58e75c87-7d44-46c4-b055-48ed950d210f",
|
|
"indicator--58e75c88-7cbc-4997-ae6f-412f950d210f",
|
|
"indicator--58e75c88-9cf8-42b7-91e6-4e33950d210f",
|
|
"indicator--58e75c8a-a068-4c59-aaa3-4612950d210f",
|
|
"indicator--58e75c8a-394c-4fdf-ba5e-4423950d210f",
|
|
"indicator--58e75c8b-5ee4-4f27-9ac8-445d950d210f",
|
|
"indicator--58e75c8c-e074-4960-b5e9-4d12950d210f",
|
|
"indicator--58e75c8d-e8f0-4089-9ffb-4687950d210f",
|
|
"indicator--58e75c8e-c20c-4c00-9fbe-4f5b950d210f",
|
|
"indicator--58e75c8f-3a40-4b20-b71d-4c57950d210f",
|
|
"indicator--58e75c90-3d74-43e5-a88e-4d62950d210f",
|
|
"indicator--58e75c91-9618-4bad-a48e-4003950d210f",
|
|
"indicator--58e75c92-3308-42c1-b55d-482a950d210f",
|
|
"indicator--58e75c93-7020-444e-bc4e-48d7950d210f",
|
|
"indicator--58e75c94-aba8-405b-b0fc-4a3a950d210f",
|
|
"indicator--58e75c95-58a8-4cb3-bbd7-4fdb950d210f",
|
|
"indicator--58e75c96-972c-4c50-85c5-4d50950d210f",
|
|
"indicator--58e75c97-3384-450f-a64d-4a6c950d210f",
|
|
"indicator--58e75c98-b678-4cac-9c9e-47f3950d210f",
|
|
"indicator--58e75c99-cb68-4d5b-ae1e-41de950d210f",
|
|
"indicator--58e75c99-21dc-4178-9ebc-4d3e950d210f",
|
|
"indicator--58e75c9a-9334-4e3b-a338-44c7950d210f",
|
|
"indicator--58e75c9b-c810-4570-b1be-4218950d210f",
|
|
"indicator--58e75c9c-cef8-45f6-bf57-4fd3950d210f",
|
|
"indicator--58e75c9d-34e8-45a8-ab9b-400d950d210f",
|
|
"indicator--58e75c9e-5f94-45b4-b3f9-4e67950d210f",
|
|
"indicator--58e75c9f-7814-4f76-8c71-47a0950d210f",
|
|
"indicator--58e75ca0-b6e4-4ce0-a0fb-4dc9950d210f",
|
|
"indicator--58e75ca1-06fc-4d2d-b347-4ebe950d210f",
|
|
"indicator--58e75ca2-6524-4e60-9ea4-4093950d210f",
|
|
"indicator--58e75ca3-7c84-4ddb-9477-4e8f950d210f",
|
|
"indicator--58e75ca4-3ec4-45a1-8bb4-4a8f950d210f",
|
|
"indicator--58e75ca5-9324-46eb-91ab-4a6c950d210f",
|
|
"indicator--58e75ca6-52dc-4dab-83c6-4a09950d210f",
|
|
"indicator--58e75ca7-c11c-4983-9476-4fd1950d210f",
|
|
"indicator--58e75ca8-2344-4969-bb01-4ef7950d210f",
|
|
"indicator--58e75ca9-aa94-4330-bea1-4e24950d210f",
|
|
"indicator--58e75caa-d810-498e-9828-442a950d210f",
|
|
"indicator--58e75cab-1a20-4fce-9f9a-427c950d210f",
|
|
"indicator--58e75cac-1650-4304-9791-479d950d210f",
|
|
"indicator--58e75cad-70c4-4a37-bc39-4ed6950d210f",
|
|
"indicator--58e75cae-9cd4-4103-83cd-426d950d210f",
|
|
"indicator--58e75caf-0720-4a62-84df-454d950d210f",
|
|
"indicator--58e75cb0-4748-45b1-b7a3-45a3950d210f",
|
|
"indicator--58e75cb1-e124-4d4a-b4f5-4f18950d210f",
|
|
"indicator--58e75cb2-2150-4d90-844a-4e88950d210f",
|
|
"indicator--58e75cb3-0238-4c9f-9479-4695950d210f",
|
|
"indicator--58e75cb4-bda0-4a5a-9482-487f950d210f",
|
|
"indicator--58e75cb5-f01c-4b38-a15a-45d2950d210f",
|
|
"indicator--58e75cb6-f854-44fe-9e3d-49f5950d210f",
|
|
"indicator--58e75cb7-b9a4-4c3d-9935-4204950d210f",
|
|
"indicator--58e75cb8-3ea8-4820-8864-408a950d210f",
|
|
"indicator--58e75cb9-bc98-435d-a696-4756950d210f",
|
|
"indicator--58e75cb9-dc14-4d09-babe-4a27950d210f",
|
|
"indicator--58e75cba-f418-45e1-b302-41e5950d210f",
|
|
"indicator--58e75cbb-fea4-40e0-afda-4284950d210f",
|
|
"indicator--58e75cbc-9910-4dda-a0d4-4a37950d210f",
|
|
"indicator--58e75cbd-5df8-478f-ab0f-4eec950d210f",
|
|
"indicator--58e75cbe-52fc-4d83-aec2-4d80950d210f",
|
|
"indicator--58e75cbf-0414-410c-a37e-48ac950d210f",
|
|
"indicator--58e75cc0-3488-44a2-9866-4d2b950d210f",
|
|
"indicator--58e75cc1-00a8-4cbb-b3ff-4a65950d210f",
|
|
"indicator--58e75cc2-d154-4def-988e-42d2950d210f",
|
|
"indicator--58e75cc3-77a8-4eed-8384-4af4950d210f",
|
|
"indicator--58e75cc4-9c00-4cca-b9f0-42cb950d210f",
|
|
"indicator--58e75cc5-8c0c-4aef-a58d-4464950d210f",
|
|
"indicator--58e75cc6-1260-4e24-89ce-48ba950d210f",
|
|
"indicator--58e75cc7-ff50-460b-b250-4c11950d210f",
|
|
"indicator--58e75cc8-97a4-40b0-aefe-485d950d210f",
|
|
"indicator--58e75cc8-c040-4df2-a91a-47d5950d210f",
|
|
"indicator--58e75cc9-36f8-4434-aa8c-4ebc950d210f",
|
|
"indicator--58e75cca-5ce0-4e21-b12b-4b0b950d210f",
|
|
"indicator--58e75ccb-53bc-4c2c-bb6f-49a0950d210f",
|
|
"indicator--58e75ccc-d9d8-4ee3-8e70-44f1950d210f",
|
|
"indicator--58e75ccd-d9e4-4928-9708-4747950d210f",
|
|
"indicator--58e75cce-c1e8-4149-b609-4bc7950d210f",
|
|
"indicator--58e75ccf-ffdc-4ca0-ae88-4bac950d210f",
|
|
"indicator--58e76004-2134-4de5-8317-48f1950d210f",
|
|
"indicator--58e76005-10f0-492c-b429-467e950d210f",
|
|
"indicator--58e76006-fde0-487b-b34f-43b9950d210f",
|
|
"indicator--58e76007-a464-4628-8840-4541950d210f",
|
|
"indicator--58e76008-cc58-4eae-959f-4d75950d210f",
|
|
"indicator--58e76009-5c90-401f-bb71-4b22950d210f",
|
|
"indicator--58e7600a-3124-49cb-9777-44ee950d210f",
|
|
"indicator--58e7600b-2174-44af-8778-4f42950d210f",
|
|
"indicator--58e7600c-de54-4db4-a5da-4af1950d210f",
|
|
"indicator--58e7600d-2c34-414f-a4f7-4b3c950d210f",
|
|
"indicator--58e7600e-8de0-42ec-ab49-4f2a950d210f",
|
|
"indicator--58e7600f-e144-4ce3-8b59-43d7950d210f",
|
|
"indicator--58e76010-22ac-425b-9610-49ed950d210f",
|
|
"indicator--58e76011-4ed8-42bf-9227-46dc950d210f",
|
|
"indicator--58e76012-d234-4496-bbb2-42b1950d210f",
|
|
"indicator--58e76013-0610-473a-9864-4dfd950d210f",
|
|
"indicator--58e76014-9304-4ab4-aa78-48bb950d210f",
|
|
"indicator--58e76015-6b80-4774-bb3d-49f0950d210f",
|
|
"indicator--58e76016-812c-4e53-a941-41b1950d210f",
|
|
"indicator--58e76073-d438-4100-8afb-430e950d210f",
|
|
"indicator--58e76074-9518-40b5-9f43-46fb950d210f",
|
|
"indicator--58e76075-e220-4f49-8ab8-41b4950d210f",
|
|
"indicator--58e76077-8530-497a-af29-402f950d210f",
|
|
"indicator--58e76078-4328-4627-b899-43f0950d210f",
|
|
"indicator--58e76078-617c-457e-b5bd-4a6a950d210f",
|
|
"indicator--58e76079-f520-47c3-9a9f-4dc6950d210f",
|
|
"indicator--58e7607a-2144-4ca4-a718-4c2b950d210f",
|
|
"indicator--58e76985-c430-4b80-9476-456302de0b81",
|
|
"indicator--58e76985-8f98-498a-ad4d-4ffb02de0b81",
|
|
"observed-data--58e76986-8898-4a74-a932-47f502de0b81",
|
|
"url--58e76986-8898-4a74-a932-47f502de0b81",
|
|
"indicator--58e76987-5208-427c-93a8-4fad02de0b81",
|
|
"indicator--58e76988-3f14-4b2c-9f52-467002de0b81",
|
|
"observed-data--58e76989-8a68-47db-95bd-43a302de0b81",
|
|
"url--58e76989-8a68-47db-95bd-43a302de0b81",
|
|
"indicator--58e7698a-7934-4832-a419-4ed902de0b81",
|
|
"indicator--58e7698b-813c-4c0c-acb5-4d5902de0b81",
|
|
"observed-data--58e7698b-14a4-483c-9793-425202de0b81",
|
|
"url--58e7698b-14a4-483c-9793-425202de0b81",
|
|
"indicator--58e7698c-8e64-40b9-852d-4ff402de0b81",
|
|
"indicator--58e7698d-c938-402e-be81-4f0302de0b81",
|
|
"observed-data--58e7698e-ff84-4f98-b76a-463702de0b81",
|
|
"url--58e7698e-ff84-4f98-b76a-463702de0b81",
|
|
"indicator--58e7698f-05c0-417e-94eb-4df402de0b81",
|
|
"indicator--58e76990-3144-4ea0-987f-4d1802de0b81",
|
|
"observed-data--58e76991-bf0c-4520-86b8-465e02de0b81",
|
|
"url--58e76991-bf0c-4520-86b8-465e02de0b81",
|
|
"indicator--58e76991-095c-4985-83ab-476802de0b81",
|
|
"indicator--58e76992-4c64-471e-85e3-45be02de0b81",
|
|
"observed-data--58e76993-dd28-415c-bc3b-405102de0b81",
|
|
"url--58e76993-dd28-415c-bc3b-405102de0b81",
|
|
"indicator--58e76994-96f8-4d42-a476-45b802de0b81",
|
|
"indicator--58e76995-c17c-4c74-8c88-412702de0b81",
|
|
"observed-data--58e76996-777c-417c-b177-41cd02de0b81",
|
|
"url--58e76996-777c-417c-b177-41cd02de0b81",
|
|
"indicator--58e76997-f444-432a-a39e-45f502de0b81",
|
|
"indicator--58e76998-0ad4-4a96-867d-4af802de0b81",
|
|
"observed-data--58e76999-28c8-46a9-8f97-4c9602de0b81",
|
|
"url--58e76999-28c8-46a9-8f97-4c9602de0b81",
|
|
"indicator--58e7699a-fe34-4006-96d8-4a2602de0b81",
|
|
"indicator--58e7699b-5be0-4fd9-becc-403202de0b81",
|
|
"observed-data--58e7699c-f2cc-4a61-9d7d-439a02de0b81",
|
|
"url--58e7699c-f2cc-4a61-9d7d-439a02de0b81",
|
|
"indicator--58e7699d-c450-45d3-a498-44a602de0b81",
|
|
"indicator--58e7699d-0fec-4005-a24f-4b5402de0b81",
|
|
"observed-data--58e7699e-e220-4811-99d2-4bfd02de0b81",
|
|
"url--58e7699e-e220-4811-99d2-4bfd02de0b81",
|
|
"indicator--58e7699f-f014-43c6-b1a6-402302de0b81",
|
|
"indicator--58e769a0-a590-4fab-873c-430302de0b81",
|
|
"observed-data--58e769a1-94a4-455f-b69c-4a9a02de0b81",
|
|
"url--58e769a1-94a4-455f-b69c-4a9a02de0b81",
|
|
"indicator--58e769a2-3ec4-4703-88e6-452502de0b81",
|
|
"indicator--58e769a3-32e0-41e4-a262-421202de0b81",
|
|
"observed-data--58e769a4-da48-413e-8b18-426f02de0b81",
|
|
"url--58e769a4-da48-413e-8b18-426f02de0b81",
|
|
"indicator--58e769a5-2970-4c57-ab7c-430902de0b81",
|
|
"indicator--58e769a6-de98-443a-90d0-424302de0b81",
|
|
"observed-data--58e769a7-673c-404e-87c3-4b9402de0b81",
|
|
"url--58e769a7-673c-404e-87c3-4b9402de0b81",
|
|
"indicator--58e769a8-d59c-4412-9dbb-4add02de0b81",
|
|
"indicator--58e769a8-08b4-485f-964a-4bcb02de0b81",
|
|
"observed-data--58e769a9-2a24-4a46-baee-428002de0b81",
|
|
"url--58e769a9-2a24-4a46-baee-428002de0b81",
|
|
"indicator--58e769aa-aa6c-49e9-a28d-4e7e02de0b81",
|
|
"indicator--58e769ab-2fdc-43c2-8a8e-464e02de0b81",
|
|
"observed-data--58e769ac-a7e8-44a8-b91b-4d8f02de0b81",
|
|
"url--58e769ac-a7e8-44a8-b91b-4d8f02de0b81",
|
|
"indicator--58e769ad-21f0-4743-a2b8-4e3202de0b81",
|
|
"indicator--58e769ae-a9e8-4414-aa4f-4ce902de0b81",
|
|
"observed-data--58e769af-d1dc-430a-87e4-4f1d02de0b81",
|
|
"url--58e769af-d1dc-430a-87e4-4f1d02de0b81",
|
|
"indicator--58e769b0-7b3c-4cb9-b10e-430c02de0b81",
|
|
"indicator--58e769b1-2814-43f4-9a37-44ea02de0b81",
|
|
"observed-data--58e769b1-0bf0-4d79-897a-4de002de0b81",
|
|
"url--58e769b1-0bf0-4d79-897a-4de002de0b81",
|
|
"indicator--58e769b2-ba04-4086-b2f4-467902de0b81",
|
|
"indicator--58e769b3-9cb4-45de-9160-422f02de0b81",
|
|
"observed-data--58e769b4-e31c-4303-b9c1-4e6f02de0b81",
|
|
"url--58e769b4-e31c-4303-b9c1-4e6f02de0b81",
|
|
"indicator--58e769b5-7bec-4058-bfdb-410c02de0b81",
|
|
"indicator--58e769b6-3fac-4f80-8ac9-45df02de0b81",
|
|
"observed-data--58e769b7-c318-4cca-b93a-462d02de0b81",
|
|
"url--58e769b7-c318-4cca-b93a-462d02de0b81",
|
|
"indicator--58e769b8-4d08-4306-b5a7-461802de0b81",
|
|
"indicator--58e769b9-2524-4b29-a4c5-4a2302de0b81",
|
|
"observed-data--58e769ba-e080-4c93-a6c5-45fc02de0b81",
|
|
"url--58e769ba-e080-4c93-a6c5-45fc02de0b81",
|
|
"indicator--58e769ba-7964-472b-a87e-42c802de0b81",
|
|
"indicator--58e769bb-ce40-4a9d-bd9f-4f4e02de0b81",
|
|
"observed-data--58e769bc-b868-4f1e-95ee-41f502de0b81",
|
|
"url--58e769bc-b868-4f1e-95ee-41f502de0b81",
|
|
"indicator--58e769bd-5a04-4469-bd17-448102de0b81",
|
|
"indicator--58e769be-fcec-4bca-a7a1-4b5e02de0b81",
|
|
"observed-data--58e769bf-0564-494c-bd28-474f02de0b81",
|
|
"url--58e769bf-0564-494c-bd28-474f02de0b81",
|
|
"indicator--58e769c0-a22c-47ac-8d8e-418302de0b81",
|
|
"indicator--58e769c1-bf54-426e-9ec1-44f302de0b81",
|
|
"observed-data--58e769c2-b4d4-4bd3-a073-460402de0b81",
|
|
"url--58e769c2-b4d4-4bd3-a073-460402de0b81",
|
|
"indicator--58e769c3-e568-49f9-abde-464302de0b81",
|
|
"indicator--58e769c4-8918-49d4-b1e8-4f8e02de0b81",
|
|
"observed-data--58e769c5-5994-4597-9d9c-406302de0b81",
|
|
"url--58e769c5-5994-4597-9d9c-406302de0b81",
|
|
"indicator--58e769c6-0754-4a30-881f-497c02de0b81",
|
|
"indicator--58e769c7-3f74-4340-9dca-42c502de0b81",
|
|
"observed-data--58e769c8-63d4-454f-87be-409e02de0b81",
|
|
"url--58e769c8-63d4-454f-87be-409e02de0b81",
|
|
"indicator--58e769c9-bad4-4512-98b1-4b1b02de0b81",
|
|
"indicator--58e769ca-fb9c-4de3-9073-470602de0b81",
|
|
"observed-data--58e769cb-8f2c-459e-9963-4eae02de0b81",
|
|
"url--58e769cb-8f2c-459e-9963-4eae02de0b81",
|
|
"indicator--58e769cc-4524-4d30-8f6d-4ed502de0b81",
|
|
"indicator--58e769cd-61a4-499b-b60e-42f502de0b81",
|
|
"observed-data--58e769ce-6790-4468-86f3-478002de0b81",
|
|
"url--58e769ce-6790-4468-86f3-478002de0b81",
|
|
"indicator--58e769cf-2cb4-40b5-ab48-454902de0b81",
|
|
"indicator--58e769d0-0b24-40a0-bc2b-4d6802de0b81",
|
|
"observed-data--58e769d1-2c58-4e1e-b2e7-40b902de0b81",
|
|
"url--58e769d1-2c58-4e1e-b2e7-40b902de0b81",
|
|
"indicator--58e769d3-d8d8-41e2-889e-4ff402de0b81",
|
|
"indicator--58e769d3-c408-4aba-9311-40ad02de0b81",
|
|
"observed-data--58e769d4-8dc8-49f3-9e32-4e2902de0b81",
|
|
"url--58e769d4-8dc8-49f3-9e32-4e2902de0b81",
|
|
"indicator--58e769d5-b23c-4893-ac35-4ba802de0b81",
|
|
"indicator--58e769d6-8c84-498b-a78e-493802de0b81",
|
|
"observed-data--58e769d7-fbd8-46e1-af8e-430102de0b81",
|
|
"url--58e769d7-fbd8-46e1-af8e-430102de0b81",
|
|
"indicator--58e769d9-4e20-437c-887d-47b302de0b81",
|
|
"indicator--58e769da-1684-41b6-ae88-4bca02de0b81",
|
|
"observed-data--58e769db-fc08-43c6-b902-401902de0b81",
|
|
"url--58e769db-fc08-43c6-b902-401902de0b81",
|
|
"indicator--58e769dc-e490-4595-bcc7-479a02de0b81",
|
|
"indicator--58e769dd-6be8-4a75-be30-436802de0b81",
|
|
"observed-data--58e769de-c308-4c07-8eec-453a02de0b81",
|
|
"url--58e769de-c308-4c07-8eec-453a02de0b81",
|
|
"indicator--58e769df-f364-4190-98b0-414b02de0b81",
|
|
"indicator--58e769df-4a40-4c43-8382-4b1b02de0b81",
|
|
"observed-data--58e769e1-fa78-4eb5-8787-469202de0b81",
|
|
"url--58e769e1-fa78-4eb5-8787-469202de0b81",
|
|
"indicator--58e769e1-6110-476c-a086-4c0502de0b81",
|
|
"indicator--58e769e2-f088-42ec-b603-406902de0b81",
|
|
"observed-data--58e769e3-c4b8-48d6-be75-411b02de0b81",
|
|
"url--58e769e3-c4b8-48d6-be75-411b02de0b81",
|
|
"indicator--58e769e4-c020-4c12-bdde-471c02de0b81",
|
|
"indicator--58e769e5-d768-43d0-a302-433e02de0b81",
|
|
"observed-data--58e769e6-822c-4cdf-bf63-41cd02de0b81",
|
|
"url--58e769e6-822c-4cdf-bf63-41cd02de0b81",
|
|
"indicator--58e769e7-d9fc-4ada-9b8f-43cc02de0b81",
|
|
"indicator--58e769e8-e7f8-4483-8c01-4ba802de0b81",
|
|
"observed-data--58e769e9-f7dc-42c8-9673-446902de0b81",
|
|
"url--58e769e9-f7dc-42c8-9673-446902de0b81",
|
|
"indicator--58e769ea-41a4-4cbf-bcfb-419602de0b81",
|
|
"indicator--58e769eb-2784-4d3d-9e4a-49ff02de0b81",
|
|
"observed-data--58e769ec-dc98-4b75-ac9e-4d6d02de0b81",
|
|
"url--58e769ec-dc98-4b75-ac9e-4d6d02de0b81",
|
|
"indicator--58e769ed-787c-425a-9007-4a9f02de0b81",
|
|
"indicator--58e769ee-b490-4a87-9b06-4f4202de0b81",
|
|
"observed-data--58e769ef-ed94-498a-a169-4a7902de0b81",
|
|
"url--58e769ef-ed94-498a-a169-4a7902de0b81",
|
|
"indicator--58e769f0-43a0-48cf-878d-490d02de0b81",
|
|
"indicator--58e769f0-8bc0-4833-a010-47e402de0b81",
|
|
"observed-data--58e769f1-0b7c-46db-8125-41a002de0b81",
|
|
"url--58e769f1-0b7c-46db-8125-41a002de0b81",
|
|
"indicator--58e769f2-c0c8-434a-ace3-406102de0b81",
|
|
"indicator--58e769f3-eaa4-416b-a6d1-41ac02de0b81",
|
|
"observed-data--58e769f4-2cf8-43f1-98fe-449102de0b81",
|
|
"url--58e769f4-2cf8-43f1-98fe-449102de0b81",
|
|
"indicator--58e769f5-ffbc-45b9-936e-4bee02de0b81",
|
|
"indicator--58e769f6-736c-41e1-9f38-4c7b02de0b81",
|
|
"observed-data--58e769f7-3900-458c-86ca-45d202de0b81",
|
|
"url--58e769f7-3900-458c-86ca-45d202de0b81",
|
|
"indicator--58e769f8-6c14-44ac-9bfb-4c8d02de0b81",
|
|
"indicator--58e769f9-73b0-4d94-99f8-441c02de0b81",
|
|
"observed-data--58e769fa-0590-4063-878f-438702de0b81",
|
|
"url--58e769fa-0590-4063-878f-438702de0b81",
|
|
"indicator--58e769fc-cbd4-47f1-9208-44a602de0b81",
|
|
"indicator--58e769fd-eb58-4c50-842b-424702de0b81",
|
|
"observed-data--58e769fd-ac68-477d-89c4-465d02de0b81",
|
|
"url--58e769fd-ac68-477d-89c4-465d02de0b81",
|
|
"indicator--58e769fe-3ea4-4e3b-964f-492502de0b81",
|
|
"indicator--58e769ff-ea38-4296-b3d8-4b0b02de0b81",
|
|
"observed-data--58e76a00-c060-43e1-8cd0-4e9d02de0b81",
|
|
"url--58e76a00-c060-43e1-8cd0-4e9d02de0b81",
|
|
"indicator--58e76a01-478c-44d9-88c1-40c602de0b81",
|
|
"indicator--58e76a02-f5d0-45ae-8f56-4ff802de0b81",
|
|
"observed-data--58e76a03-7edc-4855-a29c-425702de0b81",
|
|
"url--58e76a03-7edc-4855-a29c-425702de0b81",
|
|
"indicator--58e76a04-c4c8-499c-be0d-4f5d02de0b81",
|
|
"indicator--58e76a05-bb68-4f5c-8d4b-4d7502de0b81",
|
|
"observed-data--58e76a06-6d70-4843-aaad-461402de0b81",
|
|
"url--58e76a06-6d70-4843-aaad-461402de0b81",
|
|
"indicator--58e76a07-8208-4e1e-adb4-49fc02de0b81",
|
|
"indicator--58e76a08-ef84-46d1-a7ef-4a4202de0b81",
|
|
"observed-data--58e76a09-5df8-4dde-9cca-40d702de0b81",
|
|
"url--58e76a09-5df8-4dde-9cca-40d702de0b81",
|
|
"indicator--58e76a0a-09a8-418d-83ad-492702de0b81",
|
|
"indicator--58e76a0b-e3a8-43bb-9637-44e302de0b81",
|
|
"observed-data--58e76a0c-96b8-4919-bf73-426302de0b81",
|
|
"url--58e76a0c-96b8-4919-bf73-426302de0b81",
|
|
"indicator--58e76a0d-4e78-4218-b7ba-46b902de0b81",
|
|
"indicator--58e76a0e-7720-4d1c-85a5-4e5e02de0b81",
|
|
"observed-data--58e76a0e-a874-4953-8b5e-4b6002de0b81",
|
|
"url--58e76a0e-a874-4953-8b5e-4b6002de0b81",
|
|
"indicator--58e76a0f-d1bc-4233-8092-406f02de0b81",
|
|
"indicator--58e76a10-2b4c-43af-87b9-431602de0b81",
|
|
"observed-data--58e76a11-3900-411b-9ad0-42f402de0b81",
|
|
"url--58e76a11-3900-411b-9ad0-42f402de0b81",
|
|
"indicator--58e76a12-865c-4e0a-8c9a-449e02de0b81",
|
|
"indicator--58e76a13-a4cc-4375-bf12-440002de0b81",
|
|
"observed-data--58e76a14-bedc-4c56-aaa8-421002de0b81",
|
|
"url--58e76a14-bedc-4c56-aaa8-421002de0b81",
|
|
"indicator--58e76a15-7794-48e7-9dbe-442802de0b81",
|
|
"indicator--58e76a16-da9c-498e-80f1-430102de0b81",
|
|
"observed-data--58e76a16-83b0-4b2b-93bf-454d02de0b81",
|
|
"url--58e76a16-83b0-4b2b-93bf-454d02de0b81",
|
|
"indicator--58e76a17-4468-46ce-88de-4e4602de0b81",
|
|
"indicator--58e76a18-5c28-49d0-97b0-481a02de0b81",
|
|
"observed-data--58e76a19-9af0-401f-9c5e-416102de0b81",
|
|
"url--58e76a19-9af0-401f-9c5e-416102de0b81",
|
|
"indicator--58e76a1a-ec34-4399-acef-4af802de0b81",
|
|
"indicator--58e76a1b-b460-441c-8b3a-463e02de0b81",
|
|
"observed-data--58e76a1c-5a84-424a-9de6-402a02de0b81",
|
|
"url--58e76a1c-5a84-424a-9de6-402a02de0b81",
|
|
"indicator--58e76a1d-3e70-431f-938f-46e202de0b81",
|
|
"indicator--58e76a1e-305c-40f1-a9a9-4c3c02de0b81",
|
|
"observed-data--58e76a1f-5aa8-490f-8c32-470d02de0b81",
|
|
"url--58e76a1f-5aa8-490f-8c32-470d02de0b81",
|
|
"indicator--58e76a20-bcc0-4366-adf7-4dd202de0b81",
|
|
"indicator--58e76a21-b7b0-48be-933c-442802de0b81",
|
|
"observed-data--58e76a22-43a0-42f0-bc6c-41e702de0b81",
|
|
"url--58e76a22-43a0-42f0-bc6c-41e702de0b81",
|
|
"indicator--58e76a23-ddc0-4522-b0e5-458602de0b81",
|
|
"indicator--58e76a24-f38c-408b-b06a-4f1302de0b81",
|
|
"observed-data--58e76a24-6b10-44da-822d-4cf402de0b81",
|
|
"url--58e76a24-6b10-44da-822d-4cf402de0b81",
|
|
"indicator--58e76a25-f520-4b54-996e-4de602de0b81",
|
|
"indicator--58e76a26-aa50-48ca-838b-4d4902de0b81",
|
|
"observed-data--58e76a27-bd74-4dd2-9095-437602de0b81",
|
|
"url--58e76a27-bd74-4dd2-9095-437602de0b81",
|
|
"indicator--58e76a28-ea74-4f62-8a69-463b02de0b81",
|
|
"indicator--58e76a29-8f5c-4aef-b253-4dd402de0b81",
|
|
"observed-data--58e76a2a-d734-49ed-a4bf-425d02de0b81",
|
|
"url--58e76a2a-d734-49ed-a4bf-425d02de0b81",
|
|
"indicator--58e76a2b-95e8-4585-8a50-470c02de0b81",
|
|
"indicator--58e76a2c-47d4-43dc-b63e-4fdd02de0b81",
|
|
"observed-data--58e76a2d-56f0-4ba4-8cc7-486702de0b81",
|
|
"url--58e76a2d-56f0-4ba4-8cc7-486702de0b81",
|
|
"indicator--58e76a2e-d0f8-423c-b4b9-455c02de0b81",
|
|
"indicator--58e76a2f-c514-41bf-842b-4fdb02de0b81",
|
|
"observed-data--58e76a30-0b00-4c1f-a7a6-491d02de0b81",
|
|
"url--58e76a30-0b00-4c1f-a7a6-491d02de0b81",
|
|
"indicator--58e76a31-c1c8-4735-98af-4e0d02de0b81",
|
|
"indicator--58e76a32-f634-48be-88d3-4c4302de0b81",
|
|
"observed-data--58e76a32-a9ec-4da1-a0e7-476802de0b81",
|
|
"url--58e76a32-a9ec-4da1-a0e7-476802de0b81",
|
|
"indicator--58e76a33-ab24-42d1-9a71-406402de0b81",
|
|
"indicator--58e76a34-9540-4a74-9ce9-475802de0b81",
|
|
"observed-data--58e76a35-36b0-4de5-82a6-4dde02de0b81",
|
|
"url--58e76a35-36b0-4de5-82a6-4dde02de0b81",
|
|
"indicator--58e76a36-18ac-48dc-a789-4f1402de0b81",
|
|
"indicator--58e76a37-a2a0-44e9-8bc0-4efc02de0b81",
|
|
"observed-data--58e76a38-6048-4748-907e-481b02de0b81",
|
|
"url--58e76a38-6048-4748-907e-481b02de0b81",
|
|
"indicator--58e76a39-7e94-4889-8e59-44e202de0b81",
|
|
"indicator--58e76a3a-b148-4576-9885-434802de0b81",
|
|
"observed-data--58e76a3b-8ec0-4cdd-a96f-4ef702de0b81",
|
|
"url--58e76a3b-8ec0-4cdd-a96f-4ef702de0b81",
|
|
"indicator--58e76a3c-3480-4974-b649-4c7202de0b81",
|
|
"indicator--58e76a3c-7a84-488e-8e4c-493502de0b81",
|
|
"observed-data--58e76a3d-3780-4f67-b869-4d4d02de0b81",
|
|
"url--58e76a3d-3780-4f67-b869-4d4d02de0b81",
|
|
"indicator--58e76a3e-4884-4434-b1f6-4ee802de0b81",
|
|
"indicator--58e76a3f-9098-4aec-8f41-433502de0b81",
|
|
"observed-data--58e76a40-a2b0-4298-9ac2-4c7602de0b81",
|
|
"url--58e76a40-a2b0-4298-9ac2-4c7602de0b81",
|
|
"indicator--58e76a41-dac0-454a-8555-40d402de0b81",
|
|
"indicator--58e76a42-0c80-4351-80f4-496002de0b81",
|
|
"observed-data--58e76a43-2908-4093-8859-459d02de0b81",
|
|
"url--58e76a43-2908-4093-8859-459d02de0b81",
|
|
"indicator--58e76a44-95bc-43f5-9fd6-4e5502de0b81",
|
|
"indicator--58e76a45-5a30-4391-a37a-46da02de0b81",
|
|
"observed-data--58e76a46-ad8c-4eb6-aaf8-48c402de0b81",
|
|
"url--58e76a46-ad8c-4eb6-aaf8-48c402de0b81",
|
|
"indicator--58e76a47-332c-4b05-a157-462102de0b81",
|
|
"indicator--58e76a47-0bcc-4a86-ac2d-456002de0b81",
|
|
"observed-data--58e76a48-1810-4726-9136-4ca702de0b81",
|
|
"url--58e76a48-1810-4726-9136-4ca702de0b81",
|
|
"indicator--58e76a49-6fa8-4548-858e-40dc02de0b81",
|
|
"indicator--58e76a4a-93ac-4373-8db6-440002de0b81",
|
|
"observed-data--58e76a4b-cf98-478f-830f-4b7502de0b81",
|
|
"url--58e76a4b-cf98-478f-830f-4b7502de0b81",
|
|
"indicator--58e76a4c-fc7c-4f2c-b0de-424102de0b81",
|
|
"indicator--58e76a4d-bbbc-42ed-9381-4e7c02de0b81",
|
|
"observed-data--58e76a4e-39f4-4f61-a3b2-467802de0b81",
|
|
"url--58e76a4e-39f4-4f61-a3b2-467802de0b81",
|
|
"indicator--58e76a4f-c950-4741-88a3-4f7f02de0b81",
|
|
"indicator--58e76a50-722c-4a05-9d59-480c02de0b81",
|
|
"observed-data--58e76a51-5888-43e4-80c6-4d1f02de0b81",
|
|
"url--58e76a51-5888-43e4-80c6-4d1f02de0b81",
|
|
"indicator--58e76a52-3ae0-49e1-aa3b-40f002de0b81",
|
|
"indicator--58e76a52-62b0-4e3e-8011-459802de0b81",
|
|
"observed-data--58e76a53-902c-41bc-9223-4a4d02de0b81",
|
|
"url--58e76a53-902c-41bc-9223-4a4d02de0b81",
|
|
"indicator--58e76a54-6c90-494e-9334-428802de0b81",
|
|
"indicator--58e76a55-0b6c-4e77-a096-456f02de0b81",
|
|
"observed-data--58e76a56-bf4c-4626-908e-472b02de0b81",
|
|
"url--58e76a56-bf4c-4626-908e-472b02de0b81",
|
|
"indicator--58e76a57-6c84-40c4-9751-40c702de0b81",
|
|
"indicator--58e76a58-e09c-49d0-8fa9-4eff02de0b81",
|
|
"observed-data--58e76a59-37b0-426a-a8c9-437802de0b81",
|
|
"url--58e76a59-37b0-426a-a8c9-437802de0b81",
|
|
"indicator--58e76a5a-1304-491f-bc44-468c02de0b81",
|
|
"indicator--58e76a5b-dc80-4789-9597-455702de0b81",
|
|
"observed-data--58e76a5c-927c-4a0a-97e3-4bfb02de0b81",
|
|
"url--58e76a5c-927c-4a0a-97e3-4bfb02de0b81",
|
|
"indicator--58e76a5d-2248-4432-8d44-4a8202de0b81",
|
|
"indicator--58e76a5e-f670-43de-b790-4df602de0b81",
|
|
"observed-data--58e76a5e-2220-45ea-a97c-44da02de0b81",
|
|
"url--58e76a5e-2220-45ea-a97c-44da02de0b81",
|
|
"indicator--58e76a5f-cad0-4a6b-88c3-4a1402de0b81",
|
|
"indicator--58e76a60-32dc-47c4-a235-414502de0b81",
|
|
"observed-data--58e76a61-f768-4c20-95b9-419902de0b81",
|
|
"url--58e76a61-f768-4c20-95b9-419902de0b81",
|
|
"indicator--58e76a62-0c48-4f52-9e5c-4b1c02de0b81",
|
|
"indicator--58e76a63-21ac-49ce-827b-4fbc02de0b81",
|
|
"observed-data--58e76a64-0dc4-4f73-9093-46bd02de0b81",
|
|
"url--58e76a64-0dc4-4f73-9093-46bd02de0b81",
|
|
"indicator--58e76a65-1314-4c72-b3a1-48fb02de0b81",
|
|
"indicator--58e76a66-2340-41da-92a5-4d8702de0b81",
|
|
"observed-data--58e76a67-cf74-476f-a34e-44ad02de0b81",
|
|
"url--58e76a67-cf74-476f-a34e-44ad02de0b81",
|
|
"indicator--58e76a67-88a4-4577-9dba-4bdb02de0b81",
|
|
"indicator--58e76a68-f644-41c6-b3f9-46aa02de0b81",
|
|
"observed-data--58e76a69-a2f0-4b00-85d5-467602de0b81",
|
|
"url--58e76a69-a2f0-4b00-85d5-467602de0b81",
|
|
"indicator--58e76a6a-2984-4c86-a48f-493302de0b81",
|
|
"indicator--58e76a6b-81b4-4ba5-9dcc-434102de0b81",
|
|
"observed-data--58e76a6c-84a4-426b-a659-49b302de0b81",
|
|
"url--58e76a6c-84a4-426b-a659-49b302de0b81",
|
|
"indicator--58e76a6d-3f14-4599-bedb-404402de0b81",
|
|
"indicator--58e76a6e-4558-451e-ac9b-4ab502de0b81",
|
|
"observed-data--58e76a6e-c314-401e-b556-4e8302de0b81",
|
|
"url--58e76a6e-c314-401e-b556-4e8302de0b81",
|
|
"indicator--58e76a6f-6de0-4f8a-bcc5-49fb02de0b81",
|
|
"indicator--58e76a70-1da0-4431-9406-476902de0b81",
|
|
"observed-data--58e76a71-459c-49d1-abf8-4b8002de0b81",
|
|
"url--58e76a71-459c-49d1-abf8-4b8002de0b81",
|
|
"indicator--58e76a72-1588-496b-be88-42c802de0b81",
|
|
"indicator--58e76a73-7654-4089-976d-44b702de0b81",
|
|
"observed-data--58e76a74-28d0-49b0-8a11-453d02de0b81",
|
|
"url--58e76a74-28d0-49b0-8a11-453d02de0b81",
|
|
"indicator--58e76a75-0040-4f4c-8da5-49ab02de0b81",
|
|
"indicator--58e76a75-f248-433e-9e97-44ce02de0b81",
|
|
"observed-data--58e76a76-75d8-4bbb-b365-4d1902de0b81",
|
|
"url--58e76a76-75d8-4bbb-b365-4d1902de0b81",
|
|
"indicator--58e76a77-aeb4-4858-8279-40f602de0b81",
|
|
"indicator--58e76a78-1c20-4612-a7f1-4be202de0b81",
|
|
"observed-data--58e76a79-fee4-49f2-8ef9-4c2602de0b81",
|
|
"url--58e76a79-fee4-49f2-8ef9-4c2602de0b81",
|
|
"indicator--58e76a7a-7d84-4f84-8701-486802de0b81",
|
|
"indicator--58e76a7b-b448-4f49-8166-4f0c02de0b81",
|
|
"observed-data--58e76a7c-613c-41f6-9dea-4b8402de0b81",
|
|
"url--58e76a7c-613c-41f6-9dea-4b8402de0b81",
|
|
"indicator--58e76a7c-1894-4af5-b3dc-4a1602de0b81",
|
|
"indicator--58e76a7d-4e64-4701-95d4-4a4402de0b81",
|
|
"observed-data--58e76a7e-8ad0-4fb1-8683-49d302de0b81",
|
|
"url--58e76a7e-8ad0-4fb1-8683-49d302de0b81",
|
|
"indicator--58e76a7f-b200-43a4-bfea-475702de0b81",
|
|
"indicator--58e76a80-3490-484e-b4c1-4ee802de0b81",
|
|
"observed-data--58e76a81-7780-4597-8e30-43b502de0b81",
|
|
"url--58e76a81-7780-4597-8e30-43b502de0b81",
|
|
"indicator--58e76a82-2528-4927-8a4d-420102de0b81",
|
|
"indicator--58e76a82-8754-4115-bd03-45f602de0b81",
|
|
"observed-data--58e76a83-ea84-4800-934a-47f202de0b81",
|
|
"url--58e76a83-ea84-4800-934a-47f202de0b81",
|
|
"indicator--58e76a84-15f8-4337-82df-43e002de0b81",
|
|
"indicator--58e76a85-684c-45a8-862c-4fc302de0b81",
|
|
"observed-data--58e76a86-27f0-4f2c-b362-4d4302de0b81",
|
|
"url--58e76a86-27f0-4f2c-b362-4d4302de0b81",
|
|
"indicator--58e76a87-f008-4447-9b2b-44df02de0b81",
|
|
"indicator--58e76a88-6e90-41c8-b050-4fe002de0b81",
|
|
"observed-data--58e76a89-bc34-488d-ba95-4c8102de0b81",
|
|
"url--58e76a89-bc34-488d-ba95-4c8102de0b81",
|
|
"indicator--58e76a8a-2ebc-4e16-9119-493f02de0b81",
|
|
"indicator--58e76a8a-783c-4fde-af56-4c5602de0b81",
|
|
"observed-data--58e76a8b-2f48-4f4b-9bdd-453c02de0b81",
|
|
"url--58e76a8b-2f48-4f4b-9bdd-453c02de0b81",
|
|
"indicator--58e76a8c-6e68-48ef-920d-49af02de0b81",
|
|
"indicator--58e76a8d-b81c-4ab0-85fb-413b02de0b81",
|
|
"observed-data--58e76a8e-e610-453a-b28c-49a602de0b81",
|
|
"url--58e76a8e-e610-453a-b28c-49a602de0b81",
|
|
"indicator--58e76a8f-4638-482e-816d-4ae902de0b81",
|
|
"indicator--58e76a90-03f8-4049-980a-46f002de0b81",
|
|
"observed-data--58e76a90-0c10-4602-a95d-439702de0b81",
|
|
"url--58e76a90-0c10-4602-a95d-439702de0b81",
|
|
"indicator--58e76a91-f280-4897-a087-41cf02de0b81",
|
|
"indicator--58e76a92-f390-4ca1-a922-468902de0b81",
|
|
"observed-data--58e76a93-6ef4-48b9-8e4c-4d0c02de0b81",
|
|
"url--58e76a93-6ef4-48b9-8e4c-4d0c02de0b81",
|
|
"indicator--58e76a94-a938-46c5-a4a9-4c2802de0b81",
|
|
"indicator--58e76a95-c998-4dcf-a2f9-490802de0b81",
|
|
"observed-data--58e76a96-a0a0-4dc4-8c2a-475202de0b81",
|
|
"url--58e76a96-a0a0-4dc4-8c2a-475202de0b81",
|
|
"indicator--58e76a97-dca0-4162-b6d5-4c9002de0b81",
|
|
"indicator--58e76a97-a324-4b8c-9338-43e102de0b81",
|
|
"observed-data--58e76a98-e038-42df-9020-441b02de0b81",
|
|
"url--58e76a98-e038-42df-9020-441b02de0b81",
|
|
"indicator--58e76a99-f808-40c6-ac19-43b802de0b81",
|
|
"indicator--58e76a9a-326c-44a1-b991-4bf902de0b81",
|
|
"observed-data--58e76a9b-8078-4f1e-b173-4bd902de0b81",
|
|
"url--58e76a9b-8078-4f1e-b173-4bd902de0b81",
|
|
"indicator--58e76a9c-8d70-4d23-a546-478a02de0b81",
|
|
"indicator--58e76a9d-9eac-4efd-80dc-417002de0b81",
|
|
"observed-data--58e76a9d-f9bc-4aaa-9b06-45b702de0b81",
|
|
"url--58e76a9d-f9bc-4aaa-9b06-45b702de0b81",
|
|
"indicator--58e76a9e-fb98-4850-a22d-453302de0b81",
|
|
"indicator--58e76a9f-8874-41f9-bc29-4db802de0b81",
|
|
"observed-data--58e76aa0-d760-4077-a445-41f902de0b81",
|
|
"url--58e76aa0-d760-4077-a445-41f902de0b81",
|
|
"indicator--58e76aa1-40e4-4d81-9580-4b5f02de0b81",
|
|
"indicator--58e76aa2-4560-418e-986e-444f02de0b81",
|
|
"observed-data--58e76aa3-2ccc-405b-aae7-439a02de0b81",
|
|
"url--58e76aa3-2ccc-405b-aae7-439a02de0b81",
|
|
"indicator--58e76aa4-23c4-4bc1-9e65-4d9b02de0b81",
|
|
"indicator--58e76aa4-4d10-44be-8529-4a7302de0b81",
|
|
"observed-data--58e76aa5-6e58-4081-964e-4e1f02de0b81",
|
|
"url--58e76aa5-6e58-4081-964e-4e1f02de0b81",
|
|
"indicator--58e76aa6-c380-480e-8667-439802de0b81",
|
|
"indicator--58e76aa7-a398-42d9-b917-458402de0b81",
|
|
"observed-data--58e76aa8-dc0c-4081-b074-454102de0b81",
|
|
"url--58e76aa8-dc0c-4081-b074-454102de0b81",
|
|
"indicator--58e76aa9-eab4-4402-8634-4fc002de0b81",
|
|
"indicator--58e76aaa-4594-4b5a-9d82-40b602de0b81",
|
|
"observed-data--58e76aaa-d1bc-434d-99ae-481002de0b81",
|
|
"url--58e76aaa-d1bc-434d-99ae-481002de0b81",
|
|
"indicator--58e76aab-7f7c-4487-a100-450202de0b81",
|
|
"indicator--58e76aac-91d0-4ad4-87ba-453b02de0b81",
|
|
"observed-data--58e76aad-e5b8-4560-ab5c-44f002de0b81",
|
|
"url--58e76aad-e5b8-4560-ab5c-44f002de0b81",
|
|
"indicator--58e76aae-23dc-43d9-b659-4e1902de0b81",
|
|
"indicator--58e76aaf-d9d8-4b52-b5d5-406102de0b81",
|
|
"observed-data--58e76ab0-dfa4-41c1-a2a6-422602de0b81",
|
|
"url--58e76ab0-dfa4-41c1-a2a6-422602de0b81",
|
|
"indicator--58e76ab0-2f80-4caf-b6fa-4d1d02de0b81",
|
|
"indicator--58e76ab1-1db0-4b5b-9f65-48b402de0b81",
|
|
"observed-data--58e76ab2-d35c-4b4d-a45d-4c1e02de0b81",
|
|
"url--58e76ab2-d35c-4b4d-a45d-4c1e02de0b81",
|
|
"indicator--58e76ab3-1e04-45f1-a0f0-417c02de0b81",
|
|
"indicator--58e76ab4-9f80-4378-9e65-47d302de0b81",
|
|
"observed-data--58e76ab5-3030-495d-9e77-436802de0b81",
|
|
"url--58e76ab5-3030-495d-9e77-436802de0b81",
|
|
"indicator--58e76ab6-814c-4216-aa49-4be502de0b81",
|
|
"indicator--58e76ab7-395c-42df-8bbe-4ffc02de0b81",
|
|
"observed-data--58e76ab8-02e4-45b5-8505-4afa02de0b81",
|
|
"url--58e76ab8-02e4-45b5-8505-4afa02de0b81",
|
|
"indicator--58e76ab9-2d64-4235-b9a8-4cb402de0b81",
|
|
"indicator--58e76ab9-b484-4342-ba9f-4dc502de0b81",
|
|
"observed-data--58e76aba-e980-45a8-9486-406202de0b81",
|
|
"url--58e76aba-e980-45a8-9486-406202de0b81",
|
|
"indicator--58e76abb-67dc-4fbe-996a-4e4802de0b81",
|
|
"indicator--58e76abc-8d34-4f19-bca7-4d5d02de0b81",
|
|
"observed-data--58e76abd-ede0-4dc6-8dc2-472002de0b81",
|
|
"url--58e76abd-ede0-4dc6-8dc2-472002de0b81",
|
|
"indicator--58e76abe-ed70-4d93-9a91-4b0f02de0b81",
|
|
"indicator--58e76abf-efa0-47c8-9530-46da02de0b81",
|
|
"observed-data--58e76ac0-5aec-4583-90e1-453d02de0b81",
|
|
"url--58e76ac0-5aec-4583-90e1-453d02de0b81",
|
|
"indicator--58e76ac0-0964-4a32-b22f-440b02de0b81",
|
|
"indicator--58e76ac1-4234-46a0-8ff6-486002de0b81",
|
|
"observed-data--58e76ac2-40c4-4eca-894b-4eb702de0b81",
|
|
"url--58e76ac2-40c4-4eca-894b-4eb702de0b81",
|
|
"indicator--58e76ac3-a1b0-4ba2-ab41-444902de0b81",
|
|
"indicator--58e76ac4-2560-4ee5-ac9a-4a9502de0b81",
|
|
"observed-data--58e76ac5-a648-439e-9034-4d0f02de0b81",
|
|
"url--58e76ac5-a648-439e-9034-4d0f02de0b81",
|
|
"indicator--58e76ac6-96bc-4480-872a-403e02de0b81",
|
|
"indicator--58e76ac7-8b68-4ef9-87dd-481102de0b81",
|
|
"observed-data--58e76ac7-72a0-4d5e-a73d-498b02de0b81",
|
|
"url--58e76ac7-72a0-4d5e-a73d-498b02de0b81",
|
|
"indicator--58e76ac8-8098-4fc8-a837-4e7502de0b81",
|
|
"indicator--58e76ac9-44e0-4ce1-8777-48dc02de0b81",
|
|
"observed-data--58e76aca-496c-4a43-a62c-40b902de0b81",
|
|
"url--58e76aca-496c-4a43-a62c-40b902de0b81",
|
|
"indicator--58e76acb-a76c-4ff3-ae2e-44e002de0b81",
|
|
"indicator--58e76acd-b184-4aa5-8c06-439802de0b81",
|
|
"observed-data--58e76ace-4ee0-4634-9de8-4f6002de0b81",
|
|
"url--58e76ace-4ee0-4634-9de8-4f6002de0b81",
|
|
"indicator--58e76acf-4e50-4828-a427-460802de0b81",
|
|
"indicator--58e76ad0-2584-4c4d-8c8d-4ca702de0b81",
|
|
"observed-data--58e76ad1-9800-4a13-a0ca-42bf02de0b81",
|
|
"url--58e76ad1-9800-4a13-a0ca-42bf02de0b81",
|
|
"indicator--58e76ad2-124c-41d3-a7a3-453902de0b81",
|
|
"indicator--58e76ad3-5ed4-4786-a71f-40ff02de0b81",
|
|
"observed-data--58e76ad4-ab70-4ead-a862-4a5402de0b81",
|
|
"url--58e76ad4-ab70-4ead-a862-4a5402de0b81",
|
|
"indicator--58e76ad5-2e18-4e8c-b259-4dcf02de0b81",
|
|
"indicator--58e76ad5-c848-48cc-82f3-451902de0b81",
|
|
"observed-data--58e76ad6-a580-4dec-887c-482e02de0b81",
|
|
"url--58e76ad6-a580-4dec-887c-482e02de0b81",
|
|
"indicator--58e76ad7-4af0-451e-aacb-477502de0b81",
|
|
"indicator--58e76ad8-d6c0-4e9b-b83a-4c6802de0b81",
|
|
"observed-data--58e76ad9-dc30-42fc-a2e5-43b102de0b81",
|
|
"url--58e76ad9-dc30-42fc-a2e5-43b102de0b81",
|
|
"indicator--58e76ada-4afc-4ef4-8072-434f02de0b81",
|
|
"indicator--58e76adb-19c4-40c0-a6da-4fee02de0b81",
|
|
"observed-data--58e76adc-b70c-4bb9-a952-43ad02de0b81",
|
|
"url--58e76adc-b70c-4bb9-a952-43ad02de0b81",
|
|
"indicator--58e76add-1b98-4f6a-8820-428402de0b81",
|
|
"indicator--58e76ade-91c0-4910-a327-49f202de0b81",
|
|
"observed-data--58e76adf-8f54-4189-b348-4fe802de0b81",
|
|
"url--58e76adf-8f54-4189-b348-4fe802de0b81",
|
|
"indicator--58e76ae0-7188-42e0-9cc2-4f6202de0b81",
|
|
"indicator--58e76ae0-099c-4394-992b-4b3002de0b81",
|
|
"observed-data--58e76ae1-971c-4242-8633-497a02de0b81",
|
|
"url--58e76ae1-971c-4242-8633-497a02de0b81",
|
|
"indicator--58e76ae2-00c8-4cc1-851c-4d7502de0b81",
|
|
"indicator--58e76ae3-b9a4-4c4a-b676-44f802de0b81",
|
|
"observed-data--58e76ae4-74b4-4bec-9e97-447002de0b81",
|
|
"url--58e76ae4-74b4-4bec-9e97-447002de0b81",
|
|
"indicator--58e76ae5-c1f8-48bc-bb29-478202de0b81",
|
|
"indicator--58e76ae5-24ac-4689-90f5-47fa02de0b81",
|
|
"observed-data--58e76ae6-d60c-49c4-b3ea-4b0002de0b81",
|
|
"url--58e76ae6-d60c-49c4-b3ea-4b0002de0b81",
|
|
"indicator--58e76ae7-3cd8-4540-83e7-4b6b02de0b81",
|
|
"indicator--58e76ae8-43e8-4b9b-ab11-457902de0b81",
|
|
"observed-data--58e76ae9-24bc-4784-b800-474402de0b81",
|
|
"url--58e76ae9-24bc-4784-b800-474402de0b81",
|
|
"indicator--58e76aea-4d2c-4e8d-84a5-43af02de0b81",
|
|
"indicator--58e76aeb-96b8-49c2-b3a6-48f002de0b81",
|
|
"observed-data--58e76aec-250c-4c44-b3d8-4deb02de0b81",
|
|
"url--58e76aec-250c-4c44-b3d8-4deb02de0b81",
|
|
"indicator--58e76aee-2218-4428-b415-45fe02de0b81",
|
|
"indicator--58e76aef-b38c-4ecd-ab79-4a5202de0b81",
|
|
"observed-data--58e76af0-8a5c-4cae-a292-4dfb02de0b81",
|
|
"url--58e76af0-8a5c-4cae-a292-4dfb02de0b81",
|
|
"indicator--58e76af1-3ec8-415b-889d-429a02de0b81",
|
|
"indicator--58e76af2-8b74-4b64-b332-41ac02de0b81",
|
|
"observed-data--58e76af3-031c-40bb-8a3d-4ca402de0b81",
|
|
"url--58e76af3-031c-40bb-8a3d-4ca402de0b81",
|
|
"indicator--58e76af4-9088-439e-8463-4ff702de0b81",
|
|
"indicator--58e76af5-79a0-45cb-9bea-4af002de0b81",
|
|
"observed-data--58e76af6-f7a4-4ddb-a920-463e02de0b81",
|
|
"url--58e76af6-f7a4-4ddb-a920-463e02de0b81",
|
|
"indicator--58e76af7-d5a4-4e8f-8e5c-40f102de0b81",
|
|
"indicator--58e76af8-55a0-4ee2-97b0-41a702de0b81",
|
|
"observed-data--58e76af9-b584-40c7-ab6e-4f9002de0b81",
|
|
"url--58e76af9-b584-40c7-ab6e-4f9002de0b81",
|
|
"indicator--58e76afa-b430-4f7c-be63-464f02de0b81",
|
|
"indicator--58e76afb-e0b8-4fd3-8552-4a4402de0b81",
|
|
"observed-data--58e76afc-366c-4731-8648-42fe02de0b81",
|
|
"url--58e76afc-366c-4731-8648-42fe02de0b81",
|
|
"indicator--58e76afd-ab98-4adb-b6bc-4ad302de0b81",
|
|
"indicator--58e76afe-2e7c-4dda-a643-4c2f02de0b81",
|
|
"observed-data--58e76aff-9fec-4fe1-8e95-4c1d02de0b81",
|
|
"url--58e76aff-9fec-4fe1-8e95-4c1d02de0b81",
|
|
"indicator--58e76b00-35a0-496f-b48a-499402de0b81",
|
|
"indicator--58e76b00-bfac-4835-a430-46cb02de0b81",
|
|
"observed-data--58e76b01-a440-4ffc-85b2-431902de0b81",
|
|
"url--58e76b01-a440-4ffc-85b2-431902de0b81",
|
|
"indicator--58e76b02-3854-47e8-84c0-41e302de0b81",
|
|
"indicator--58e76b04-ccd4-4c61-a002-4b3d02de0b81",
|
|
"observed-data--58e76b05-0768-4d0b-85ad-477702de0b81",
|
|
"url--58e76b05-0768-4d0b-85ad-477702de0b81",
|
|
"indicator--58e76b06-26d8-45b0-9a9a-4f0e02de0b81",
|
|
"indicator--58e76b06-9408-4621-8456-41e702de0b81",
|
|
"observed-data--58e76b07-d1f0-435a-9bb9-413e02de0b81",
|
|
"url--58e76b07-d1f0-435a-9bb9-413e02de0b81",
|
|
"indicator--58e76b08-df60-4c64-80cc-4d8c02de0b81",
|
|
"indicator--58e76b09-8ae0-4c54-8989-4bd102de0b81",
|
|
"observed-data--58e76b0a-1260-4fd8-a611-4d7202de0b81",
|
|
"url--58e76b0a-1260-4fd8-a611-4d7202de0b81",
|
|
"indicator--58e76b0b-d69c-40a5-be61-408502de0b81",
|
|
"indicator--58e76b0c-0b60-4742-bd6d-4bd702de0b81",
|
|
"observed-data--58e76b0d-8f28-4444-a269-496f02de0b81",
|
|
"url--58e76b0d-8f28-4444-a269-496f02de0b81",
|
|
"indicator--58e76b0e-f460-4429-99fa-44e102de0b81",
|
|
"indicator--58e76b0f-c190-4a8f-bba8-45be02de0b81",
|
|
"observed-data--58e76b10-411c-4942-8416-4a3202de0b81",
|
|
"url--58e76b10-411c-4942-8416-4a3202de0b81",
|
|
"indicator--58e76b11-aeb4-41ce-92ff-46ff02de0b81",
|
|
"indicator--58e76b11-42b0-444b-8dbb-402502de0b81",
|
|
"observed-data--58e76b12-d9dc-47a0-9f50-428402de0b81",
|
|
"url--58e76b12-d9dc-47a0-9f50-428402de0b81",
|
|
"indicator--58e76b13-d86c-4ed4-a63d-485702de0b81",
|
|
"indicator--58e76b14-c6f4-4876-a9bd-47be02de0b81",
|
|
"observed-data--58e76b15-6604-4bac-98c1-429b02de0b81",
|
|
"url--58e76b15-6604-4bac-98c1-429b02de0b81",
|
|
"indicator--58e76b16-0724-486c-9bfb-469f02de0b81",
|
|
"indicator--58e76b17-8c64-4664-be49-446c02de0b81",
|
|
"observed-data--58e76b17-f398-4d26-bd48-4e5302de0b81",
|
|
"url--58e76b17-f398-4d26-bd48-4e5302de0b81",
|
|
"indicator--58e76b18-0cc0-4712-9863-4eeb02de0b81",
|
|
"indicator--58e76b19-f5f0-4ca2-8784-401a02de0b81",
|
|
"observed-data--58e76b1a-31d4-418b-89f3-495302de0b81",
|
|
"url--58e76b1a-31d4-418b-89f3-495302de0b81",
|
|
"indicator--58e76b1b-19cc-422f-9e4f-4c7c02de0b81",
|
|
"indicator--58e76b1c-1eb8-4e92-acde-444e02de0b81",
|
|
"observed-data--58e76b1d-60cc-4688-be6b-457602de0b81",
|
|
"url--58e76b1d-60cc-4688-be6b-457602de0b81",
|
|
"indicator--58e76b1d-337c-4a73-9fba-411502de0b81",
|
|
"indicator--58e76b1e-45fc-4d37-96b7-4ae302de0b81",
|
|
"observed-data--58e76b1f-08e8-4729-9273-4bc802de0b81",
|
|
"url--58e76b1f-08e8-4729-9273-4bc802de0b81",
|
|
"indicator--58e76b20-29d4-4296-b67d-479602de0b81",
|
|
"indicator--58e76b21-dba8-4320-aa8d-4bbb02de0b81",
|
|
"observed-data--58e76b22-8c1c-4b7b-b77b-4c8402de0b81",
|
|
"url--58e76b22-8c1c-4b7b-b77b-4c8402de0b81",
|
|
"indicator--58e76b23-0614-417f-a3e0-4acb02de0b81",
|
|
"indicator--58e76b24-a5a4-4346-ab01-4cc502de0b81",
|
|
"observed-data--58e76b24-22a8-49ac-9be4-482702de0b81",
|
|
"url--58e76b24-22a8-49ac-9be4-482702de0b81",
|
|
"indicator--58e76b25-e278-4628-b0a7-4e0502de0b81",
|
|
"indicator--58e76b26-c384-42e2-9f85-4c0302de0b81",
|
|
"observed-data--58e76b27-219c-4e43-93ad-464802de0b81",
|
|
"url--58e76b27-219c-4e43-93ad-464802de0b81",
|
|
"indicator--58e76b28-ed58-4022-9a9b-43e302de0b81",
|
|
"indicator--58e76b29-75f4-4488-a665-433902de0b81",
|
|
"observed-data--58e76b2a-25c0-424d-8958-45ed02de0b81",
|
|
"url--58e76b2a-25c0-424d-8958-45ed02de0b81",
|
|
"indicator--58e76b2a-4664-4563-bec8-4fd502de0b81",
|
|
"indicator--58e76b2b-c6cc-4baf-9bb0-441602de0b81",
|
|
"observed-data--58e76b2c-60e0-4763-a027-42b102de0b81",
|
|
"url--58e76b2c-60e0-4763-a027-42b102de0b81",
|
|
"indicator--58e76b2d-1254-4349-aa2b-44c802de0b81",
|
|
"indicator--58e76b2e-9118-44e3-86bd-447202de0b81",
|
|
"observed-data--58e76b2f-a870-41f8-84b9-4b8f02de0b81",
|
|
"url--58e76b2f-a870-41f8-84b9-4b8f02de0b81",
|
|
"indicator--58e76b30-e50c-4018-bc1c-424f02de0b81",
|
|
"indicator--58e76b30-b9cc-4e67-a95e-4dd402de0b81",
|
|
"observed-data--58e76b31-21a8-4b3b-8289-40b602de0b81",
|
|
"url--58e76b31-21a8-4b3b-8289-40b602de0b81",
|
|
"indicator--58e76b32-a1ac-42e9-9ef2-4bfb02de0b81",
|
|
"indicator--58e76b33-c38c-40bf-bc05-4fa702de0b81",
|
|
"observed-data--58e76b34-e1a0-45e1-a1d8-45ff02de0b81",
|
|
"url--58e76b34-e1a0-45e1-a1d8-45ff02de0b81",
|
|
"indicator--58e76b35-7d58-4b7e-8152-4f8302de0b81",
|
|
"indicator--58e76b36-0e54-42d1-b2c4-4c1802de0b81",
|
|
"observed-data--58e76b36-ca48-40e1-9c2f-4bac02de0b81",
|
|
"url--58e76b36-ca48-40e1-9c2f-4bac02de0b81",
|
|
"indicator--58e76b37-aeb8-46c8-b827-477502de0b81",
|
|
"indicator--58e76b38-7f98-4ea5-bee1-4be802de0b81",
|
|
"observed-data--58e76b39-dfcc-4a2d-b741-4a5c02de0b81",
|
|
"url--58e76b39-dfcc-4a2d-b741-4a5c02de0b81",
|
|
"indicator--58e76b3a-b914-44aa-96f4-418d02de0b81",
|
|
"indicator--58e76b3b-9244-439d-9dee-456102de0b81",
|
|
"observed-data--58e76b3c-596c-4342-a9e0-4ddc02de0b81",
|
|
"url--58e76b3c-596c-4342-a9e0-4ddc02de0b81",
|
|
"indicator--58e76b3c-488c-48c8-9e1a-4a3702de0b81",
|
|
"indicator--58e76b3d-a0dc-4f09-95bf-456002de0b81",
|
|
"observed-data--58e76b3e-cd2c-4457-8800-487002de0b81",
|
|
"url--58e76b3e-cd2c-4457-8800-487002de0b81",
|
|
"indicator--58e76b3f-8a88-434a-9ca9-408302de0b81",
|
|
"indicator--58e76b40-235c-460f-9c1e-429002de0b81",
|
|
"observed-data--58e76b41-8ab8-49fa-8ccd-4f7102de0b81",
|
|
"url--58e76b41-8ab8-49fa-8ccd-4f7102de0b81",
|
|
"indicator--58e76b42-4d6c-4402-bb5b-417d02de0b81",
|
|
"indicator--58e76b42-e4a8-4cd0-8b56-4d0d02de0b81",
|
|
"observed-data--58e76b43-e610-4e03-a8b0-46c802de0b81",
|
|
"url--58e76b43-e610-4e03-a8b0-46c802de0b81",
|
|
"indicator--58e76b44-21e8-41c8-b0b7-4ef402de0b81",
|
|
"indicator--58e76b45-a818-46a1-94bb-493902de0b81",
|
|
"observed-data--58e76b46-7f58-49b3-8f7b-458c02de0b81",
|
|
"url--58e76b46-7f58-49b3-8f7b-458c02de0b81",
|
|
"indicator--58e76b47-e44c-4569-8cf1-468302de0b81",
|
|
"indicator--58e76b48-fa78-4692-8663-4df502de0b81",
|
|
"observed-data--58e76b48-ec3c-4773-accf-44e002de0b81",
|
|
"url--58e76b48-ec3c-4773-accf-44e002de0b81",
|
|
"indicator--58e76b49-7c4c-4b6c-aab7-422602de0b81",
|
|
"indicator--58e76b4a-7b70-49cd-9e4e-4cd602de0b81",
|
|
"observed-data--58e76b4b-6db8-4709-b787-4c8e02de0b81",
|
|
"url--58e76b4b-6db8-4709-b787-4c8e02de0b81",
|
|
"indicator--58e76b4c-3c78-42c9-823b-4cb002de0b81",
|
|
"indicator--58e76b4d-8d08-48e2-8971-47f602de0b81",
|
|
"observed-data--58e76b4e-40c8-4afd-aba5-4bfb02de0b81",
|
|
"url--58e76b4e-40c8-4afd-aba5-4bfb02de0b81",
|
|
"indicator--58e76b4e-aaac-42e2-9383-4ecd02de0b81",
|
|
"indicator--58e76b4f-b050-4f18-9faa-490f02de0b81",
|
|
"observed-data--58e76b50-acf8-419d-8f37-4b5402de0b81",
|
|
"url--58e76b50-acf8-419d-8f37-4b5402de0b81",
|
|
"indicator--58e76b51-76a0-4131-9ee6-441602de0b81",
|
|
"indicator--58e76b52-32b0-412e-b9d9-49be02de0b81",
|
|
"observed-data--58e76b53-e670-4012-b5ba-45c002de0b81",
|
|
"url--58e76b53-e670-4012-b5ba-45c002de0b81",
|
|
"indicator--58e76b54-3944-47ca-be56-470702de0b81",
|
|
"indicator--58e76b55-c378-4931-be8c-47f002de0b81",
|
|
"observed-data--58e76b55-138c-4401-abd2-4b3d02de0b81",
|
|
"url--58e76b55-138c-4401-abd2-4b3d02de0b81",
|
|
"indicator--58e76b56-fafc-47f0-ba96-4c3e02de0b81",
|
|
"indicator--58e76b57-faa4-44f2-8285-40eb02de0b81",
|
|
"observed-data--58e76b58-9fd4-4687-b43b-485402de0b81",
|
|
"url--58e76b58-9fd4-4687-b43b-485402de0b81",
|
|
"indicator--58e76b59-051c-4cc8-85b9-498202de0b81",
|
|
"indicator--58e76b5a-2390-40d9-b9bb-47e902de0b81",
|
|
"observed-data--58e76b5b-7384-4a7f-b286-478102de0b81",
|
|
"url--58e76b5b-7384-4a7f-b286-478102de0b81",
|
|
"indicator--58e76b5c-dcc0-4e01-9e34-4b0f02de0b81",
|
|
"indicator--58e76b5d-4698-48e5-a700-4a5202de0b81",
|
|
"observed-data--58e76b5e-acdc-46b2-85cf-40f102de0b81",
|
|
"url--58e76b5e-acdc-46b2-85cf-40f102de0b81",
|
|
"indicator--58e76b5f-d334-49ba-975f-4c6102de0b81",
|
|
"indicator--58e76b5f-93f4-45ae-b413-413502de0b81",
|
|
"observed-data--58e76b60-d1f0-4829-ba67-4c8702de0b81",
|
|
"url--58e76b60-d1f0-4829-ba67-4c8702de0b81",
|
|
"indicator--58e76b61-4f5c-4787-ab65-4e0f02de0b81",
|
|
"indicator--58e76b62-f044-41c4-ab93-4d0c02de0b81",
|
|
"observed-data--58e76b63-d538-41e8-b2fd-4c9802de0b81",
|
|
"url--58e76b63-d538-41e8-b2fd-4c9802de0b81",
|
|
"indicator--58e76b64-e378-46ad-96d1-4f4e02de0b81",
|
|
"indicator--58e76b65-7d90-4d06-b15a-445902de0b81",
|
|
"observed-data--58e76b66-4c68-4778-b6f0-49d702de0b81",
|
|
"url--58e76b66-4c68-4778-b6f0-49d702de0b81",
|
|
"indicator--58e76b67-db38-4d44-bf96-47bd02de0b81",
|
|
"indicator--58e76b68-adbc-4681-a913-415d02de0b81",
|
|
"observed-data--58e76b69-0c70-4a26-9e73-4f4602de0b81",
|
|
"url--58e76b69-0c70-4a26-9e73-4f4602de0b81",
|
|
"indicator--58e76b69-7dec-4a1f-b9fa-445e02de0b81",
|
|
"indicator--58e76b6a-c834-417c-a0af-453002de0b81",
|
|
"observed-data--58e76b6b-2ac0-45fa-8282-4ce002de0b81",
|
|
"url--58e76b6b-2ac0-45fa-8282-4ce002de0b81",
|
|
"indicator--58e76b6c-68a4-4dfa-80a1-4e7102de0b81",
|
|
"indicator--58e76b6d-6654-46c9-8df9-498f02de0b81",
|
|
"observed-data--58e76b6e-0aa8-4147-bcaf-4c2002de0b81",
|
|
"url--58e76b6e-0aa8-4147-bcaf-4c2002de0b81",
|
|
"indicator--58e76b6f-49b4-4d72-aa94-41db02de0b81",
|
|
"indicator--58e76b70-e8c0-4350-9181-4f5102de0b81",
|
|
"observed-data--58e76b71-34d8-43ff-84cc-4ba602de0b81",
|
|
"url--58e76b71-34d8-43ff-84cc-4ba602de0b81",
|
|
"indicator--58e76b72-fe60-46fa-8b09-428202de0b81",
|
|
"indicator--58e76b73-4aa8-4b86-b47c-4a6b02de0b81",
|
|
"observed-data--58e76b74-87ec-44bb-a8f8-403902de0b81",
|
|
"url--58e76b74-87ec-44bb-a8f8-403902de0b81",
|
|
"indicator--58e76b74-4964-4b46-ac95-4b4002de0b81",
|
|
"indicator--58e76b75-bf00-46e6-879d-499602de0b81",
|
|
"observed-data--58e76b76-671c-4817-bfaa-4a5102de0b81",
|
|
"url--58e76b76-671c-4817-bfaa-4a5102de0b81",
|
|
"indicator--58e76b77-02dc-4064-a8a1-444602de0b81",
|
|
"indicator--58e76b78-4f1c-4f9d-a3af-420002de0b81",
|
|
"observed-data--58e76b79-7664-41ca-90a0-46a502de0b81",
|
|
"url--58e76b79-7664-41ca-90a0-46a502de0b81",
|
|
"indicator--58e76b7a-9ec4-4b7b-8e96-4f2602de0b81",
|
|
"indicator--58e76b7b-f614-48ae-abe2-466e02de0b81",
|
|
"observed-data--58e76b7c-4af4-4d0f-a92f-491702de0b81",
|
|
"url--58e76b7c-4af4-4d0f-a92f-491702de0b81",
|
|
"indicator--58e76b7d-74f8-4845-a7d2-48ad02de0b81",
|
|
"indicator--58e76b7e-80b8-4ebb-95cc-463d02de0b81",
|
|
"observed-data--58e76b7f-0e54-4729-bd59-43b802de0b81",
|
|
"url--58e76b7f-0e54-4729-bd59-43b802de0b81",
|
|
"indicator--58e76b80-1fa0-4dfc-a970-40a002de0b81",
|
|
"indicator--58e76b81-7280-4096-8451-4ab202de0b81",
|
|
"observed-data--58e76b81-43b4-4f1c-a77d-460202de0b81",
|
|
"url--58e76b81-43b4-4f1c-a77d-460202de0b81",
|
|
"indicator--58e76b82-d968-42a3-ba91-435502de0b81",
|
|
"indicator--58e76b83-0a94-402b-9f1a-44e702de0b81",
|
|
"observed-data--58e76b84-7458-4e74-b2f2-4dd402de0b81",
|
|
"url--58e76b84-7458-4e74-b2f2-4dd402de0b81",
|
|
"indicator--58e76b85-8160-4f80-96e2-405802de0b81",
|
|
"indicator--58e76b86-0a44-46cd-9280-465102de0b81",
|
|
"observed-data--58e76b87-7554-455a-bfed-4b8002de0b81",
|
|
"url--58e76b87-7554-455a-bfed-4b8002de0b81",
|
|
"indicator--58e76b88-dfe8-4145-8a89-405c02de0b81",
|
|
"indicator--58e76b89-a408-401d-b47b-4b7202de0b81",
|
|
"observed-data--58e76b8a-e108-4758-b3d0-400f02de0b81",
|
|
"url--58e76b8a-e108-4758-b3d0-400f02de0b81",
|
|
"indicator--58e76b8b-1614-4eab-996f-49fb02de0b81",
|
|
"indicator--58e76b8c-2df0-433c-af56-40a802de0b81",
|
|
"observed-data--58e76b8d-2ed0-4059-bf73-4a3f02de0b81",
|
|
"url--58e76b8d-2ed0-4059-bf73-4a3f02de0b81",
|
|
"indicator--58e76b8d-52ec-4cef-ad31-4acc02de0b81",
|
|
"indicator--58e76b8e-a638-40f1-9efc-4e2b02de0b81",
|
|
"observed-data--58e76b8f-78b0-468b-bc58-4da402de0b81",
|
|
"url--58e76b8f-78b0-468b-bc58-4da402de0b81",
|
|
"indicator--58e76b90-5a10-409a-b6d3-44e802de0b81",
|
|
"indicator--58e76b91-c798-4568-8bed-4b7d02de0b81",
|
|
"observed-data--58e76b92-61ac-4053-a624-451e02de0b81",
|
|
"url--58e76b92-61ac-4053-a624-451e02de0b81",
|
|
"indicator--58e76b93-c240-4b0f-9f65-444e02de0b81",
|
|
"indicator--58e76b94-5480-4edf-b1ac-4af502de0b81",
|
|
"observed-data--58e76b95-3450-42dd-bc00-431502de0b81",
|
|
"url--58e76b95-3450-42dd-bc00-431502de0b81",
|
|
"indicator--58e76b96-5270-4d12-bd90-432602de0b81",
|
|
"indicator--58e76b96-ae78-45d0-9ed9-420a02de0b81",
|
|
"observed-data--58e76b97-6be8-47b3-b636-410402de0b81",
|
|
"url--58e76b97-6be8-47b3-b636-410402de0b81",
|
|
"indicator--58e76b98-f334-4e6f-91b7-429102de0b81",
|
|
"indicator--58e76b99-2ab0-4f9e-a55b-4f8902de0b81",
|
|
"observed-data--58e76b9a-e4cc-448f-baf5-47a202de0b81",
|
|
"url--58e76b9a-e4cc-448f-baf5-47a202de0b81",
|
|
"indicator--58e76b9b-d5f0-40b9-89eb-4dbe02de0b81",
|
|
"indicator--58e76b9c-7968-4dac-8ca3-4ebc02de0b81",
|
|
"observed-data--58e76b9d-f02c-4707-8253-41f602de0b81",
|
|
"url--58e76b9d-f02c-4707-8253-41f602de0b81",
|
|
"indicator--58e76b9e-39a4-437f-af28-427002de0b81",
|
|
"indicator--58e76b9f-bdd8-442e-912c-4d1702de0b81",
|
|
"observed-data--58e76ba0-8dcc-4fef-baec-4faa02de0b81",
|
|
"url--58e76ba0-8dcc-4fef-baec-4faa02de0b81",
|
|
"indicator--58e76ba1-8604-4770-bc79-41ca02de0b81",
|
|
"indicator--58e76ba1-86d4-4382-9549-4ba302de0b81",
|
|
"observed-data--58e76ba2-0328-4d9c-9c8a-4dea02de0b81",
|
|
"url--58e76ba2-0328-4d9c-9c8a-4dea02de0b81",
|
|
"indicator--58e76ba3-759c-4e4b-be67-4ddb02de0b81",
|
|
"indicator--58e76ba4-3708-4c51-a7c4-447302de0b81",
|
|
"observed-data--58e76ba5-ddc4-4d09-a72e-4a5a02de0b81",
|
|
"url--58e76ba5-ddc4-4d09-a72e-4a5a02de0b81",
|
|
"indicator--58e76ba6-3134-4b83-a4b8-493602de0b81",
|
|
"indicator--58e76ba7-e174-4dfd-b5a7-4e6902de0b81",
|
|
"observed-data--58e76ba8-d0d4-4440-8159-488b02de0b81",
|
|
"url--58e76ba8-d0d4-4440-8159-488b02de0b81",
|
|
"indicator--58e76ba9-ae5c-4f47-b5f5-485b02de0b81",
|
|
"indicator--58e76baa-c524-496c-8429-46cf02de0b81",
|
|
"observed-data--58e76bab-41bc-4785-81af-4d6d02de0b81",
|
|
"url--58e76bab-41bc-4785-81af-4d6d02de0b81",
|
|
"indicator--58e76bac-1ca0-4133-92f4-4f1402de0b81",
|
|
"indicator--58e76bad-5140-4d22-a4a6-40bf02de0b81",
|
|
"observed-data--58e76bae-b180-4606-9022-4c1d02de0b81",
|
|
"url--58e76bae-b180-4606-9022-4c1d02de0b81",
|
|
"indicator--58e76baf-ce9c-43ab-98de-4e0f02de0b81",
|
|
"indicator--58e76bb0-b6cc-4ff6-ae2d-47fb02de0b81",
|
|
"observed-data--58e76bb1-a7ec-4a6a-8bc2-471502de0b81",
|
|
"url--58e76bb1-a7ec-4a6a-8bc2-471502de0b81",
|
|
"indicator--58e76bb2-ad48-429f-a9dc-4a3502de0b81",
|
|
"indicator--58e76bb3-d148-4ad3-840d-43d802de0b81",
|
|
"observed-data--58e76bb3-1198-47b4-942f-4e2502de0b81",
|
|
"url--58e76bb3-1198-47b4-942f-4e2502de0b81",
|
|
"indicator--58e76bb4-ecf4-4153-a5a8-45be02de0b81",
|
|
"indicator--58e76bb5-ab38-4ac2-9c4f-46cc02de0b81",
|
|
"observed-data--58e76bb6-1ea4-4080-b353-451802de0b81",
|
|
"url--58e76bb6-1ea4-4080-b353-451802de0b81",
|
|
"indicator--58e76bb7-c3a0-4752-aaee-42df02de0b81",
|
|
"indicator--58e76bb8-9748-4166-a4af-404002de0b81",
|
|
"observed-data--58e76bb9-6f70-4dbd-b83d-4afe02de0b81",
|
|
"url--58e76bb9-6f70-4dbd-b83d-4afe02de0b81",
|
|
"indicator--58e76bba-7c38-4bc7-8b84-470202de0b81",
|
|
"indicator--58e76bbb-ece4-4c6b-b9f6-45d302de0b81",
|
|
"observed-data--58e76bbc-1180-430c-ac75-429c02de0b81",
|
|
"url--58e76bbc-1180-430c-ac75-429c02de0b81",
|
|
"indicator--58e76bbd-2e54-47ab-960e-4ecb02de0b81",
|
|
"indicator--58e76bbe-6f74-4501-884c-462102de0b81",
|
|
"observed-data--58e76bbf-a7d8-4c8d-aa5f-403702de0b81",
|
|
"url--58e76bbf-a7d8-4c8d-aa5f-403702de0b81",
|
|
"indicator--58e76bbf-133c-433e-991a-451702de0b81",
|
|
"indicator--58e76bc0-1f64-4c3e-8772-4a0d02de0b81",
|
|
"observed-data--58e76bc1-1aa8-4a2b-98ed-400c02de0b81",
|
|
"url--58e76bc1-1aa8-4a2b-98ed-400c02de0b81",
|
|
"indicator--58e76bc2-d2e0-4d34-b339-4daa02de0b81",
|
|
"indicator--58e76bc3-5dc8-4e04-9436-4c9802de0b81",
|
|
"observed-data--58e76bc4-9240-4446-892b-4bac02de0b81",
|
|
"url--58e76bc4-9240-4446-892b-4bac02de0b81",
|
|
"indicator--58e76bc5-dfe0-4035-84be-4f8e02de0b81",
|
|
"indicator--58e76bc6-5518-46b6-8ab2-46f702de0b81",
|
|
"observed-data--58e76bc7-597c-4f2c-bb7e-4b4502de0b81",
|
|
"url--58e76bc7-597c-4f2c-bb7e-4b4502de0b81",
|
|
"indicator--58e76bc8-5fc8-492f-a849-48fd02de0b81",
|
|
"indicator--58e76bc9-5c58-4986-b3f4-4eda02de0b81",
|
|
"observed-data--58e76bca-f3e0-4b9b-ab90-417f02de0b81",
|
|
"url--58e76bca-f3e0-4b9b-ab90-417f02de0b81",
|
|
"indicator--58e76bcb-fc94-4064-9988-4dae02de0b81",
|
|
"indicator--58e76bcc-8cb8-41ac-af0b-471802de0b81",
|
|
"observed-data--58e76bcd-d1b0-4f6f-bf3e-4a2202de0b81",
|
|
"url--58e76bcd-d1b0-4f6f-bf3e-4a2202de0b81",
|
|
"indicator--58e76bce-d590-4b11-a85a-4e6302de0b81",
|
|
"indicator--58e76bcf-e9c4-4e2f-95a6-48f602de0b81",
|
|
"observed-data--58e76bcf-2a80-4064-8d59-4cb202de0b81",
|
|
"url--58e76bcf-2a80-4064-8d59-4cb202de0b81",
|
|
"indicator--58e76bd0-8c20-47d0-b1c6-42fe02de0b81",
|
|
"indicator--58e76bd1-71ac-4bf2-8b75-430802de0b81",
|
|
"observed-data--58e76bd2-3080-4174-989e-49d402de0b81",
|
|
"url--58e76bd2-3080-4174-989e-49d402de0b81",
|
|
"indicator--58e76bd3-d8f8-49eb-a354-418a02de0b81",
|
|
"indicator--58e76bd4-7098-4b33-9156-47eb02de0b81",
|
|
"observed-data--58e76bd5-9ddc-488f-9762-4b1602de0b81",
|
|
"url--58e76bd5-9ddc-488f-9762-4b1602de0b81",
|
|
"indicator--58e76bd6-b85c-4524-b9e1-440502de0b81",
|
|
"indicator--58e76bd7-b330-44e9-b8dc-4c0c02de0b81",
|
|
"observed-data--58e76bd8-de48-4e4e-b30c-401a02de0b81",
|
|
"url--58e76bd8-de48-4e4e-b30c-401a02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e7465c-2958-4e50-aacb-44a5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T12:21:18.000Z",
|
|
"modified": "2017-04-07T12:21:18.000Z",
|
|
"first_observed": "2017-04-07T12:21:18Z",
|
|
"last_observed": "2017-04-07T12:21:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e7465c-2958-4e50-aacb-44a5950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e7465c-2958-4e50-aacb-44a5950d210f",
|
|
"value": "http://researchcenter.paloaltonetworks.com/2017/04/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--58e74b45-3bd0-4dda-8a12-49b2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"labels": [
|
|
"misp:type=\"whois-registrant-email\"",
|
|
"misp:category=\"Attribution\""
|
|
],
|
|
"x_misp_category": "Attribution",
|
|
"x_misp_type": "whois-registrant-email",
|
|
"x_misp_value": "adam.swift.2016@gmail.com"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e74c05-e500-4342-88f0-43b4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'drive.acount-manager.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e74c06-fa24-4339-abd8-4fd2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "sample of KASPERAGENT hosted on drive.acount-manager[.]net",
|
|
"pattern": "[file:hashes.SHA256 = 'babf156ede8b5c2e6c961b6ffcccc5eb7a3d283b398370754061613f439d40f9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e74fd3-6748-4dcb-9cc3-440a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'babd654ef363e0645ce374dd9e2a42afe339c52f1cf17fc2285d8bebd3cfa11e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e750ac-2470-41aa-b3aa-4a80950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "C:\\vault\\igfxtray.exe",
|
|
"pattern": "[file:hashes.SHA256 = 'f26caee34184b6a53ecbc0b5ce1f52e17d39af2129561dd6361fb4d4364e2c8b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75106-c1a8-452e-940c-4e18950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "C2",
|
|
"pattern": "[domain-name:value = 'www.mailsinfo.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7516d-17e4-41f2-bb98-4d58950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "extended-capability KASPERAGENT samples",
|
|
"pattern": "[file:hashes.SHA256 = 'a52d3e65fe5bbf57bab79b1c5092b66d9650247249b72f667a927f266d09efe6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7516e-0548-438c-9833-495d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "extended-capability KASPERAGENT samples",
|
|
"pattern": "[file:hashes.SHA256 = 'c9ffb81a97a9458f1fc96f35cd187b1d7311479e77d031586abdc3d426da0859']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7516f-7160-4c8d-9719-4d89950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "extended-capability KASPERAGENT samples",
|
|
"pattern": "[file:hashes.SHA256 = '7f11e0bbc892a97b7c42416c43fe178ebb240939d9dee70c3c598305ce8a2d4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7563f-6330-4989-a699-4b16950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4c1973278a30d1b4ce206eca63676624d234260758a0674d191d338a02914d23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756dc-64fc-4c88-a32c-4215950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mediafreeuploader.co.uk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756dd-5b4c-44db-9b97-4baf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'appppure.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756de-d604-4397-9a58-4def950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload404.club']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756df-cc0c-4b44-9b10-4485950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload999.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e0-fee8-4b0c-a8e0-4a5e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload999.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e1-cd98-435f-8c5e-4806950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload999.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e2-2e74-4165-9c49-4539950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'arnani.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e3-b480-4e30-b17d-43f6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'al-amalhumandevelopment.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e3-95d8-40d3-82f2-4435950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'acount-manager.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e4-28a4-4874-bffd-43dd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'gooogel-drive.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e5-bb54-4684-86af-4ebd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'acount-manager.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e6-3674-46e0-8a33-4cdc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'acount-manager.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e7-245c-44a2-a34a-4f7b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'appppure.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e8-5ea4-44fe-9773-48eb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'stikerscloud.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756e9-953c-41c3-a848-488e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload999.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ea-ef2c-464e-9238-4d6d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'apppure.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ea-a848-4ca1-b8e7-406d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mary-crawley.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756eb-9dfc-4b74-bd16-4c6e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mydriveweb.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ec-7824-48e8-b9fe-4f88950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'google-support-team.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ed-d7f0-497e-b745-421c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mavis-dracula.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ef-5450-4ebc-896d-4776950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = '9oo91e.co']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ef-3c50-4042-8d13-40ac950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'useraccountvalidation.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f0-28d4-48d2-b6c5-4c8a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mailsinfo.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f1-79f8-456d-920f-49cd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'acount-manager.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f2-7e30-411f-93d4-4c0b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload202.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f3-31b8-477f-82ad-4954950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload909.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f4-0a58-4d73-89f0-4eba950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'upload101.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f5-c3d4-4973-b25a-45f9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mediauploader.me']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f6-cac4-4b9e-b36a-4765950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'ran-togomory.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f7-3fa0-45b6-8607-432d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'shildon-cooper.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f8-8958-4ffa-bb88-4556950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'mediauploader.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756f9-34ac-4946-8bb2-4c30950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'akashipro.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756fa-5c5c-45f8-bc6f-46e3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'beauty-dance.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756fb-2cbc-4ac1-b3fd-43cf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'margaery.co']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756fc-84d0-49a5-80ec-47b6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'go-mail-accounts.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756fd-c74c-455e-9dc3-46d4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'kagami-adam.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756fe-47b8-4250-a1cb-44c3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'kalisi.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e756ff-10a8-4d92-acba-4295950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'kalisi.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75700-8954-4563-b33a-4de0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'cecilia-dobrev.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75701-ee4c-41bf-8291-457e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'kalisi.xyz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75702-88bc-49ad-92ec-44af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'appppure.pro']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75702-23c4-47bb-9888-4681950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'cecilia-gilbert.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75703-f70c-478a-8c93-4cd8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'gooogel.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75704-f48c-4d9f-91f8-4366950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[domain-name:value = 'feteh-asefa.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759a7-b298-45b5-9b5c-41b7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2c8a67f8118b6aef159dd280d5998b1c41edb406a1bc8e3960254a9642b6ae4b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759a8-9a1c-4078-818d-42a8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a72178289bb518f9f100b78e56a9425332bf3a5220a6c5abd3d07c669a5d8b25']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759a9-e4fc-4213-a213-4dca950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '7fdf2bdc500a8703cceb76a427752ee70164b8283b4df42c5b13ed2124a88dbd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759aa-9020-4ac7-8a6d-4510950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '6926f430865bd08b621bd1c6581bfe77db3e9891b14f97d00563770186fc5e74']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759aa-ddd4-49b2-ad56-4bb8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '46b0f586a646e800ab63d1404a08864fb09aca73a13fd22542a9fce038643219']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ab-10d4-4c8a-b492-4461950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e9050c541859f2fabff6dcd492df02a48dd32d99b1f3e98ef7c14bbb6aa734a2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ac-be28-4683-a838-4750950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2709506acdb0c6aba5ce794ceada11b64078f5731b91359cb398bc967cb67eba']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ad-e874-4f0c-9caa-43b5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'fcfe51fd23aadcab5a7878bd59b5354d3491d237b259e230ac51e49306b253c7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ae-22e8-49a1-b8b8-4cd5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '1bb2a7a6c271b7e607cf87f2a4003eae1653f304cde104fc0311611cbb96e431']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759af-7da0-441f-bb77-4075950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'b384ed2a4f484b70786e5ea84ff513d30fe4d068fd76cc214d448f7f1c4329fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b0-4290-4848-84f5-4b2e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '1bbd9498f50259917d737b70a875772f963424f69fb942b86d626283e154cab2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b1-1b8c-4d02-b7af-471c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '325c5aa819dbd1596464ec018b9efb5938dbc59ac6a94c459932ef07412bca02']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b2-5b48-4f94-8614-4cc4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4b77194c47b5abb04b1395955ca25aa0bb63ce796247d22946bc07919c8e1b56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b3-84a4-417e-bf51-4c2c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '9ae853b1e678926358ac8c1cd583eb2d5968b99c2a16cf34334a22051bb630ec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b4-ec1c-4a20-9983-4f57950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '1184916919ea9790adcd53b60c4bf875e54733e508344ffe6baf10b919a0fd1d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b5-47d4-48e7-811e-4306950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'beb05e01b87e1a432b3ef37eb55db723a5a5231872a53ab777d7821358e97574']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b6-cef8-485c-bf41-477b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '433d2c8a3e93191d09e11994438ec3413152baf64e26e8d9e43c2d2e056b700c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b7-7f38-42fc-a395-432a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '783486dd30ca43d3a6c6807530c023f61631e4b3e6f2e6c2830b5209ee384e13']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b8-f6b4-4376-b698-4ccd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2813409822b56ae81f08adcaed29a215b3bef0e4f1cc5a22c7169f9e16a188a0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759b9-c440-4982-9293-40e2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '6eca9aacc7d9ef570bf2521f5a1156825832282650d2d3734d964a834f97b3f4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ba-e294-4697-8ab8-4b4e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'b8285b66aa42f61de1c43423ea25f8cbe03ebb96d0917c153476e185a5909e57']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ba-c1f4-4a1f-8cfc-4eb0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '6c51b3ca96d06cc695de3875f4d31962bb936331a82541ab610f269fec0b0a8c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759bb-aaa8-4b4c-a225-46ac950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'cd051cb14f118e33a2299925a704a56d89ba92a310f2176a0942ec29babedee6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759bc-a630-4d46-9757-482e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'd5e145bf964b91210b79b25fc92ce19aacacadac14ebeb6f4111b6f4cabfd6c7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759bd-8568-43fe-a929-48df950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '98553dacbb2fdd8d655907f29e8ba36265f931fd5c6fe83c4defafc10767d4f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759be-ca64-4063-860d-419d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e1addb50f0fea302317c40017fcdad84e1b8bc0f6d5b3f2609de2a0576ad8f9a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759bf-59bc-4dcf-8e0b-4776950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a8825be2145fb5cc25194aa13f5168ac7ede1132632cdeebadfb640d063fc781']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c0-8460-4673-b15b-4535950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'ae5625a0fe39b34884cfd33832181392e9cf5157b8070b2e1b3d04c87fb46eec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c1-36e8-4145-a947-4203950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4eca7eedcb5cfa0f02306774b9ed685a5ffc738669bb90cb5d57dad87a46833b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c2-5c20-428a-9654-4b1d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '400c9fa4012a67e88b986d206deb8b10acff3091b6e7c98f0f98ac553ebd021b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c3-fa88-4376-b240-4b05950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'c7d2a0803f9d4f9f37d5a0f3a37b97eaa672d4b3c700163847736cb9f91aabad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c4-8694-4754-99e9-4585950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '71aa4f9bc78fd5d457e4a2f2914516fc0081d2d5d22da26e1c70f86d9bd6bab1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c5-8c5c-474a-a1a2-44ad950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '117f80111e0fb67f728091a1b96042ea6f1633ece8c8a519e45e38d408a6691e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c6-d42c-40dd-a004-41a7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4ae00d8000510629bbffc55652401ee4124109c55500075049f9440fe86391cb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c6-a204-4aa8-ae75-44f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'df2f111c952ac720cb9e33afb24a1c9d0c9ecaeaea4c079f48fadc1a4ed333d5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c7-0a74-4a43-ac3f-413f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2321fbde63ceb3d0086a9bbce55940cc6f05919acf49fdb731f75447863c795c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c8-67c0-47c0-86a3-4f6f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'fa80f9b2163d7db3e026316967d241818c9e57c1376830899352115bc08d51ac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759c9-7668-4547-92d7-430e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'f296539deddb1b661868c69cde1783a2a2be15456ea3e31523652b5f10cc7d36']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ca-a0f0-465b-af28-4ca3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '11cbd7a2ce58191e4dbd3efffba97c5c4c0edd437511e2ecbd42811dac1cfa3d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759cb-f158-4f92-a9f3-4a40950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '646b6591002c125108fa1e108aa9be84f4c83f3130836279745e372ee12867cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759cc-58fc-4e75-b4dc-4973950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e771f7512bd1efc86884fad12115f2fb5abc97eef78ca7dce1fbc9fb6f23360d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759cd-456c-4a80-a4cb-4253950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '787f581acd27f8c8b449b3bc0ca214a1b3421197ff789333ef1b44a5de850c03']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ce-35c4-4ccd-9a9f-481c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'b119b2530baf4c80a5543b7c6bacb615357b2deff27d9b6a638f799617ec1641']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759cf-4d28-4a22-a5ef-4b31950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '00b9fe607cb0b6ba45cd7ffbc3d710264c6109fdbad992933f68bbfc15785a18']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d0-7e68-4a23-8be7-4260950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '34a4a989a6d83eea916c455a9c304823786f11d39c7525583f75a0fd35906a1e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d1-a3dc-450c-ba01-43c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '967fd8f1e08cde8dbc960f3d9fcac5a86b77003cae88d59be78ce0a7e6ad0d88']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d2-0ccc-4411-8392-4927950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '83d07d027709c724b146aaf44ff63d969b9c2824bb5f0b3c1be5af4f18b3cd97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d2-7cd4-47d4-b112-4302950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '42c12d9b35abbb79212bf9d35d7c391d18e2635e558eb6ab8472510df79da09f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d3-e168-4c09-8e2c-40f4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'f602d059bc6f7e1e5353b716fbbaf42fa5746e844532674198f59deec367490d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d4-efcc-4b29-b0c2-4ef4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '365be95490051c077b2bea93eb8e647cc4ab76cc51ebc6781abfca8b6d55b551']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d5-4378-4cfb-9bb3-4650950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a8635544eab476c6128793b00bf1bd48ce9d41692585aab1690f2a44837efaac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d6-3604-4945-8313-4062950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4d54b94d081fa2d0c0626805f71bca86314201a6215fbd910c98024b372158c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d7-93d0-48ba-86aa-448e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '1a609b82e95501f56f0f47014c4224fdba457b27c58672292231c3adfcfdd7eb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d8-ddf8-4008-b5c8-43be950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e58267f9ff31408d0bb1b84948e1fd3c02231cfd0628797cc2a6045354e0b065']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759d9-57f4-4a7b-8f8c-4758950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2dae0b95ba31c12c59d577b32c11ed3d1dff6db76f9c92064a2bc2764eb8611f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759da-7274-4077-b3fe-493a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5e977ffbfc3d048c79640459ab33a932f1e17f77dae76d7a062c4cb0221b91f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759db-89a8-47c9-b35c-4eb4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '78536b8ba75ba8269950099bb8205a11e94db9c28558293971e981c3a9e57b24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759dc-c3b4-4416-a743-4021950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'f0cb1d8a58b389425f691522163a1cc3b2b6c4ca0004248c0f0daad7f4ffa12a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759dd-010c-4948-a8bd-444d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '865bf72cd5f23350cba26bb185340ebc0def6b5bbd5d8c9c184e1d1e4d11c5b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759dd-3e14-408f-ad0e-4757950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'dff184a646f67fdf04fc7702e2a4ef60b4a165e56abb7e3a424f785ac8b02da9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759de-ffc0-4206-82f3-44d8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '3554b267dec35b5072ed5fce2510e70960e32195a0920811e83eb6207cc4bed0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759df-b520-4fd6-a9a0-4f6b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'baf0fe69b670a6b96489cfb0bd80b03d8b454d5a3d2407d3c1570f1db9b58927']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e0-c1c4-4aec-8c5d-4e4b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e926cf1e40c46f9578c76bb0df3a3ba7667853b63cc58b0f064f529b4365fbe0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e1-a548-416f-bd08-4209950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'bacbcb52516bb1d54b82a8d128f460843827a9dff65024d4bedb88936fc40c97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e2-d204-4f67-97c3-4169950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '618fc941c00005b02f62d9ebdb31363e4d51b2f927f3d0b36c238a333f080ad0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e3-a76c-4de3-97c6-49c5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '64c5bfc0a1c76aaf9ed8b8f2a45d229afa9353a63fa7a2bba6d4a8c47980e70b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e4-5838-4f5f-a6b0-43d8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '27b3a779d2e3d44cf0c4cc8e9f2862226fe329db7127b2272ba42011332832f3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e5-b2b0-4da8-9a3e-447a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2a71fcd81cf6c3bc6a43260b23cd7ef1c0694b0d85cdcdfdc8b25b139922a352']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e6-c438-4ac8-a7b9-419d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '244621fad10485386493efec3818196fc50f1a66e3048a62de456d64a2331720']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e7-237c-4134-a03f-4c61950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '7b1a513520f18612c4cd2ac9e5e5a1d660274a77b8f190bd277339247b6a51ee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e8-4018-4b6d-a2ab-4f3d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '7d74e531dafdb6e645ac429c17aba3903e9c0f4fe7e4f93688d37eb638c52f48']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e9-3108-441b-881e-41ec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '722cfac01badf1106887fbc985060a2fb31eabf9943520bd24abf2fa208217b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759e9-11f4-4399-8810-40f1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5a83a289c0c4c222bb190152bb8bc5f429e6799ac233ba99b7a860b8519872bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ea-99c0-41b9-b0c9-4590950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '50cb597f33f8252bd94c54927bd2e0259a732ad64fb8b413a205e1f290870445']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759eb-b910-46e3-b9c2-4a6d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'c721b5d3abc978ea8608f23b9a9a6ba81afe87d6d6660bc6006ee1ba83491d06']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ec-7674-4004-b5fb-4f5a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '16e43f8d2e439b5ce8e48b75bb25e90011f1ccbb41278fe15f7982a304a832de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ed-a5ec-4b83-bed2-4b2e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5579cfef934b47519388719f0bf532bd4326d0221b6ab47c69ca098f3d2d2de3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ee-2298-404d-a19f-4cc5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '7e476fb1089b95bfb08ec3ab3931ae31da9fd1f742928bab339d297b70b9fcc2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ef-f5a8-4c4e-88e9-4d51950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '6279030f7e5eaeacd28232de35382c38614fefc90ef753f2492300c1150e54f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f0-0cc4-4a7c-9e0b-4efa950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e4f015b6cc0539fff746dc39229d25385d95e827204695b8b0003457cd206dab']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f1-2298-4851-9596-46af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'ea6dffd2bb7c13eebdb605060b26ff2319f6f4ab81e9c41998351c039c177d5a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f2-faf4-4d30-a0e3-44ae950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4546413de0c2df37c83a88808cebe265dc74dd87c550c378f1d23d8e5430a7db']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f3-0014-4c8f-bfef-49a5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a02bdf36048e6440c50782dbbbc8e0529e4ee480bf2be43dcad2d22f3b47bc08']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f4-b470-48f0-9f2b-4772950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5e82f68b6560c959975b9e8c20a82de71fedc8dc7277d2a16c9a13829c91dd22']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f4-97b4-4208-ae60-4252950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '30912cc80cf7defaec360cdd08952ceed493e88d87ad705ec80831581c5c867d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f5-a9f0-4ef6-9cd6-42fe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '44d0c56f4037d21b85fe00e944456cf2a67e71ca3133c3afd0ea1f35d29e7b33']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f6-0a60-44ce-a8ef-445f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'bdb17c29b31fbe557200569f584c589104b52f188799dc5b45a33f3a7a16a34d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f7-7868-400d-b07e-4f25950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'c1ab9ec3f1d6050a77cc8d976dac441c13ba2fd3c0229076c20a2406258198bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f8-3a54-4fce-b8f6-481d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '397087699aa240e8a74a687902ad3c8b2a0f1535179fab046673cc1032c72796']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759f9-85f8-4c19-8dd6-47d7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2088d5f31b8f8a75464def9b02c159a2a1aa3056fc3c82056272c9b39cea0639']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759fa-efcc-447b-87f4-4320950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'bb3676b9ea838344e955cf58b01d2df4384f6ba8b62fa00259ab8c449e77f358']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759fb-f854-4113-b826-4667950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a2e979e03c32e5de9ba34407b37143b6a887ab6f9d8cdcb07a6276f41202dc5d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759fc-3028-4780-b96d-4ecb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'c24e30b7a32f096bad4385012a1c1b3a61198156b19081f7658a4f1c25d055c4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759fd-0c14-4251-bf3c-4477950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '7be574a767acb4fe9a1af425fe1fddcda17a97f4653837384352cebec21801e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759fe-7b1c-4750-9003-41c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '54b07adba4b1fd4467a2cae45480ae8f764866e8ae6bf66150f2cd860b36aaf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ff-41e8-4537-b9e2-4323950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '4550e8b216c2ef7d78be2ef572fefbdde76c0c6640c6c1cb6757a3867a9710d7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e759ff-5404-4587-998c-402c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '455be9cff65b2178189444572b0a9b31d5cc5b709bcefc7381eaf4b9141ca46f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a00-f49c-45e8-aa05-4ea9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '81410d2a560984fe41d371bd745f6de9f9f120dc929f439947f3cfc330774a95']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a01-cf40-4e46-9862-4db2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5329652e9eb2aa681abc8e69955b24165a23a807a69ae76e67c07d1fdfe8fc38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a02-85d4-4873-ac76-4f56950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '42e8118271ce2df0a3313e271d8a86f425bdcd15e1b5bd6c6239701cfad6da3f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a03-3b74-488c-98fc-406f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '8ee8572d912eca16470679fcd4d98e6e22e4446c2dd74d5d96f1056ce3a93e22']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a04-acd4-482e-9d43-4d18950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'c5fc26f84955a041de20f3ff2ee04a59f9d8a2ab5d6c4702b8da0cf03b4147ef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a05-6e64-43fc-acae-436a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'e75d209025a34fda854cb9289c1f329671fe010ba6616e24c0338eb9f17266c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a06-b7d0-4e04-bc9d-4770950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '2c0ba35cdc0ef302fc52aef368565b61edbf9c7a962661cafa4b2cfc26eda371']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a07-4314-42a3-8938-4fb3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '1c1d858934f278abac6bce5f609db8649d58ceaada00f661b6e18b0dd13946b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a08-a0ac-4b23-ae53-42f6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '31a4d2f12b5e8ab7ca06a61dc117cc5742ea222e3101e495b60f4c289f14b547']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a09-1ea0-4924-bcd9-487c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'a136bc03de8cf0b99b8aa500460a8be6aa1c98ce78515c217ad03d6faa9e08f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a0a-c0a8-4677-a150-4322950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '874febea579812e0fbbc3dc1e591264108e61864c48f9b8e15fc9644edee0621']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a0b-3948-49ad-87e4-43c1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = 'f7bd43323917ce3ce71da472593e0899dd54ce957e2621083a29680a04a263e8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75a0b-d5cc-4cee-bb16-48bc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "KASPERAGENT",
|
|
"pattern": "[file:hashes.SHA256 = '5ba356e5e96ce8b9cbccdcb11d817bb53924afdb7e3af72155898fc7bfae0920']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c77-4a74-4316-b048-4d1b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '453b9f7aed67f41ec192db3011459e2dd865bb729265c544ee1b8814c6e7dc53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c78-1964-476c-a97b-4ce3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'c9e55094b84a06b3a40b7df1cd76fc287fdc02a2cdd30af359743bbc23475917']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c79-0748-4325-9a3e-4372950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'a627d2bff74ce07a619cc8fd36294f66eab94b92d41e50b06e63d736ffafd254']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7a-b30c-4268-a943-4453950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'f70681c7e8ab419fd0938802a823337abad936cccc0ace9ee232f2b874e561f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7b-12b4-4e1b-99fa-4bdd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e3963ee9bf892d3f3eea0620585e2e773a30cf536c73a01dd51d6ce36f4daf5d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7c-8294-414a-9bd8-4c5e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e2ac3cf79e7267d2e088c3a269aa84fc71fc6073019abb94d16a024d3ad16f3e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7d-da6c-4611-98f2-4822950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b08b96eb46b65af20688c3910a8edcc7dd072a5149ca4b541183acfa81220b97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7e-b1f4-4cc4-8ab9-4123950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'cdada29d7cd7d88a49a4475a50ee0401d11e2d9a61c4396a60ab0a2fb3da0d01']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c7f-c4e0-4d46-993f-4e7f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'ca438526ad398f240d3ba551cdd59ada402a6270755c4b0750bc0b120e058320']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c80-ed44-43d7-be6e-43b9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2fc2263416b3b55e1dfe67ab6435eed00a74a82e3fbdfdbb6a3a102a7f404641']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c81-6eb0-4558-8e0e-4561950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '15c9dc07d2858f496ea7f4110a13e58e6828fe836704582dbbdc630df18d3de5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c82-3760-4bae-8563-4543950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '579cf5f112c5b542f7240e200fec6312983255b497c6f0a65f2fe2d3b78391c5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c83-ff80-4120-9469-4b88950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '15e3cd8a698d30ac7851b3232f8b7cbc7fbbb821c9eece34ef327b67dc281883']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c84-cd18-47b5-913b-4c13950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '1e5739d640e24504a5e03d0847ad720622c64d0effcd2e1b80528a055049ca82']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c85-6e80-428e-a1e7-49e8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '8f1ff9588630c3bc017468ff0eadb69c65cf77aae47a148e132eb4b48ae5c988']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c86-fbdc-4e8f-b415-4dd7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'eb5e920dd1e2b2df4cede82d0efbda1556fa35ac1c4589533fca58832fd07a62']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c87-7d44-46c4-b055-48ed950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2fac7aab5c3b922b883941fa67fdd7c197e6aaef429e723dccb3fc2150083c8d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c88-7cbc-4997-ae6f-412f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '368845729255ab7fcfb5c0b6c153929d5ccb8d1f9a40cc02ca7c026b4b6813ec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c88-9cf8-42b7-91e6-4e33950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '41b3e90442c97e40abdf29d8b7ecedea1026a1fb4dbd6d6cc410d3f3463cb205']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8a-a068-4c59-aaa3-4612950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b284c718d5b6c30eea2a0df34d9d75d3a22baa776b8d6f75b579da5549529f43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8a-394c-4fdf-ba5e-4423950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '74a94b549fd52e8c23c1fca23a80262a50ae8e08ae56adf9e94c54acf2b313bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8b-5ee4-4f27-9ac8-445d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '39aa9cc3747a7fc9c80a04ef47107950c1946386525d79fe97b0bfb593e4bdc2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8c-e074-4960-b5e9-4d12950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6c3bcef39b3892b5c3ed5602624ca5ee244cca7bf86aebe293bbd11eaf57834f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8d-e8f0-4089-9ffb-4687950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'c4e79e151986dc5e16ce763321de90d8c214909df7210ec05e590c4375423a76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8e-c20c-4c00-9fbe-4f5b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '5bab8a360d1d08e37e4e6c052f7fce13a291ad9b99f950770a647222bfc4d6b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c8f-3a40-4b20-b71d-4c57950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'accf87a349b0cfe6403e827089d7a97a8a9bf94dc4535d9ce2e54ecf9bc699fa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c90-3d74-43e5-a88e-4d62950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '4f1be1f1c28dfc337a37cf22611aa288565c294910083524be4a317306b5490c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c91-9618-4bad-a48e-4003950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6e461a8430f251db38e8911dbacd1e72bce47a89c28956115b702d13ae2b8e3b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c92-3308-42c1-b55d-482a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '7dd7cc9e90b074ecc3d8f5540864e105fc0cc034a18a0681bd0ab14252bd0387']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c93-7020-444e-bc4e-48d7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '023cee622d8ddd7afd7603c1ba13447931508140cfe0dfd85bf4adc5b0d2cf8e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c94-aba8-405b-b0fc-4a3a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '63d9a5ef92a18dc7238bcc59330b41149cec4ef7602b18c0b99abdae83c0114c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c95-58a8-4cb3-bbd7-4fdb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'adbb67b004131990598009162a195b04107231a79de25945de94d2978f96dcd5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c96-972c-4c50-85c5-4d50950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '39e4e3637e651d2d8251c0f891dc4b0f0494c9bada2da930761d3fe6cc6ebaae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c97-3384-450f-a64d-4a6c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6aeebb3cdb2ca9b325e042e76d195a5ac958b119baa559532c22d344f1491a30']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c98-b678-4cac-9c9e-47f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'fb95a719c4b26bb577cea5837cac6ba9fdfcfd240bc2fc7b1d0759bf392d5191']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c99-cb68-4d5b-ae1e-41de950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'dd185667015d23438a994adc9e9b30572a1e7479c05f563e0b6c71b8c6023685']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c99-21dc-4178-9ebc-4d3e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2cbafd6a0461e7ae1929897a8039ce5f198b76281465c49b4547abf9a139dd89']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9a-9334-4e3b-a338-44c7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b6f8b5ba026af863e878eded79f40e5efa1dd7ce725cd0479e5f062dbf4fdd4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9b-c810-4570-b1be-4218950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'cfbe077d7a4807203c889292668695e114ed9524a11a00b0d670a2f4da74a27c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9c-cef8-45f6-bf57-4fd3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'd8d87ac1e004de113a5a394b757f612bcde22eaaab574e53d4b1909193b77b7f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9d-34e8-45a8-ab9b-400d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6eea4d800b3af9363abcea6f5051039c2fe7bec3e690500077f022204588db6f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9e-5f94-45b4-b3f9-4e67950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2b644917074452c385e4a960d9ef504ce22733047dc282ef31ba7c012041e58c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75c9f-7814-4f76-8c71-47a0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '499569d014d6b05e2187b8aa5966e4b56133cd67ff7a110c259cda5299cdd4b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca0-b6e4-4ce0-a0fb-4dc9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '0edc4424c8eeb9708b6b8bc74806b6c17c9cfbb49e2688f711092381823fc733']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca1-06fc-4d2d-b347-4ebe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'a9ad6b278cabc7c9ac063c37b0656cd924639a227977ff250339479d5aa0863a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca2-6524-4e60-9ea4-4093950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e477b5e00699a9ccb3868de543c29087042fd44c631f8fcda5faaf7922382146']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca3-7c84-4ddb-9477-4e8f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '114ef36f968912ef885d06e3d092dad739f9b6afe2f246e52fb3ba5e6bf8ee00']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca4-3ec4-45a1-8bb4-4a8f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '85d2d2293364c90d51fba7696a44908e0fae50dae1337e59441692e91c25c9d1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca5-9324-46eb-91ab-4a6c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '7efaff81e5be73608bccad93185f6b559597d2819bb33c95436d9246ef602f49']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca6-52dc-4dab-83c6-4a09950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2e225c32dc320ab2441274fc7acf6fe52bd9621314c27e806fa8c4bec409b5e3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca7-c11c-4983-9476-4fd1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '8f3e3b93eddb3f1fecc75d46e9ea5eb5d2ba3283c1e040ca12cb7530b7eb2455']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca8-2344-4969-bb01-4ef7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '75329e7b79284f63c1383244b20fb0d9c4bb1e9c4feba04307f1223db30c9203']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ca9-aa94-4330-bea1-4e24950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '04f6422325cf3fbe35879cb6532745d3a3b555144ef7b4e88ed96bf3fe4e70ac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75caa-d810-498e-9828-442a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'fb64d608573ba1b1fd4254e7a1c7b3ffa1dfdc678300cc5d16eb4a88cf7592e3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cab-1a20-4fce-9f9a-427c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'a2cad08db8e151a90857df70d9e9c5e605aac6fa0e6e5d5ad150c96027743612']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cac-1650-4304-9791-479d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b5846554ee1ef9de0a8d83527f609abf5b328d104056b7a763ed89e75152ddbf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cad-70c4-4a37-bc39-4ed6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'cf9287ded9b5a6543afc66ca60c4d20e6f7e4c318e8f303567d781eb98e4168c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cae-9cd4-4103-83cd-426d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'def8065164959595de2ff6b35141985e7fd7a6c836db0b7a3f389b022c7f3650']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75caf-0720-4a62-84df-454d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '3a4498a6e4213a680dd2e57516637f7480c0bd7a342ec24788fdb9694b0d1150']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb0-4748-45b1-b7a3-45a3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6c21e4331ec2d02e427025efeb6fbaf8c779513027720d24365283d5166add77']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb1-e124-4d4a-b4f5-4f18950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e05a329bbfe8cc0f7f3e2296fe0bdf86b6d4df70a8242409feb6c846db0b221c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb2-2150-4d90-844a-4e88950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '559e6970861563f815e097a7a152970508323666c511afbc8165c4869256f692']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb3-0238-4c9f-9479-4695950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '54e5f4ecd18c6a18a6f25be6b7a392cbbd5bc107b868d8a078bf3e3fa701e453']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb4-bda0-4a5a-9482-487f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e0b2671b1ba7ac123b6ec3e152711691e8690839b8e04fbb748d2fa8a4f5e982']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb5-f01c-4b38-a15a-45d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '1adbad10e5193b7533bccbae9bfa660f29162730fd4bd89c332bf8ae5b96ae78']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb6-f854-44fe-9e3d-49f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e8ab81ee03aca399d8e4e3f6ca9d6e98c7c75e68f22e12d6213c15d8b9cc3ace']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb7-b9a4-4c3d-9935-4204950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '425d427828205811258e22cd04eb9acb4e497590eecefed77cdb9252b3e45fcb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb8-3ea8-4820-8864-408a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '876919233b24808b457fe83c815a4e6b30e415771bb6fe2e68a5cdae8e9a6c6c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb9-bc98-435d-a696-4756950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '6b676728f3206db8aa7ae57d8ee0747f2919a64ab8157b28bd1add0c15d2bb59']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cb9-dc14-4d09-babe-4a27950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '76573e0c213dbdba3283887eee7418f2b0c0ce6506145567547319bec8f0d6a6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cba-f418-45e1-b302-41e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'd1bbde1ddd5bb1b421f230ba2213013b098f2abe3ac526be142371e2728ba40f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cbb-fea4-40e0-afda-4284950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '9a32cc01c4e6120cec03aba783087df35724d5b1feb3f75fa0b78963e8cc7735']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cbc-9910-4dda-a0d4-4a37950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '699f4f0513de49db7dafa3760daa3c27ca9cd12e216ff3e042966212870bb906']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cbd-5df8-478f-ab0f-4eec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '1a4d7b935cb365f75a3f33c6490023aad054facf55a1411cd7b9d723eb99cf53']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cbe-52fc-4d83-aec2-4d80950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '14b34347a75bc46ee69e1782cb658f7f404487a8fc40b973649d53d008bc0e75']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cbf-0414-410c-a37e-48ac950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '8cf8d06d2935153d3c8d570ecd5990432bb4933ca89845bc2cd763b40ba7edb4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc0-3488-44a2-9866-4d2b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'a5daa9cf58a2f6bf3f39ae022b0c87458b3ade2d4a006e5489f2417ff639e011']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc1-00a8-4cbb-b3ff-4a65950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '582cd41417aeb2f3f86d2c9fb7f8add4e5edacfed7cae0aecc8cb088a823d240']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc2-d154-4def-988e-42d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '0d94f4aaebcdcfaf5b377af33da42e69b453297cf6b90387db95868a48c172bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc3-77a8-4eed-8384-4af4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '2f40c95693d1c0b0aa8195a7b943b935634745a1aae3ea91752ca4a535e69007']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc4-9c00-4cca-b9f0-42cb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '7f02e8bece61a3fa6400e9dcbb0972a136b1818bf1629afe4456819beb04b4cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc5-8c0c-4aef-a58d-4464950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '77dc371fcdcaae8f38e942e9084855d62f2daf81460c33f2ea64c77a470f8c8c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc6-1260-4e24-89ce-48ba950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '06a69598b2251200cbdf51c53be45ad90240fd69502063aa4afa5b1086fc34b3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc7-ff50-460b-b250-4c11950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'e73381e591dd8538641236530bda5bc0daa014e3486b11a4da820657b48db9f9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc8-97a4-40b0-aefe-485d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '027b0d9ee5258bb18c824be1b6aff33aeb3060ca3e577f2f8fff06ed4854883d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc8-c040-4df2-a91a-47d5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '7d4e98f9136c4c7952e3acbb328ad06e522718ad4d05bcd04eeb225335e75631']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cc9-36f8-4434-aa8c-4ebc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b033de3c20701482bd375ea6e45ecae38295de72336a5f96f4ab994e6cef212a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cca-5ce0-4e21-b12b-4b0b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b22b98b8d50aab1b0bea0e458e0736940215365752797de892745bafda5d9ce9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ccb-53bc-4c2c-bb6f-49a0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '75a708bf42ac01d857ecb3bff18c633e334329d4b89ae4201a989f564a2410b6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ccc-d9d8-4ee3-8e70-44f1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'b679878e940eaee79436a895aa4f43e32416c3ad2fbfeb812fc39022c84b82d9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ccd-d9e4-4928-9708-4747950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '3fce85b9c279d94dd7018a656027a496b4b5df719933630d7375c42ac088dd87']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75cce-c1e8-4149-b609-4bc7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = 'd63da6f863609c87cf283cd6da7c325f9622bff986b05c47e106855a514da4b6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e75ccf-ffdc-4ca0-ae88-4bac950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "MICROPSIA",
|
|
"pattern": "[file:hashes.SHA256 = '0e7507e955dfe8027ed5740400dda772c403510f75d066baf0077ca1ab478048']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76004-2134-4de5-8317-48f1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'd909669b000c479b8bdd9f86fa62879a7c8b4dca8cde4f4a404862a4604c52e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76005-10f0-492c-b429-467e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'b6abeffe986eb38e411a4fe956280e2028d8bef699d9dd3244bde721a99b1dee']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76006-fde0-487b-b34f-43b9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'c1564c56c46146db36ec97afd994c45f3621f39c82cc692adba5b9f6d9a62897']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76007-a464-4628-8840-4541950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'c20438ba8c9e008c1e2eb4343f177757fc260437aeac52df61b156671b07ac14']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76008-cc58-4eae-959f-4d75950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '5f3b4eddcc72598721b9ca395d1e5881acbd4fc562e09b688b2d42f65d3a4a93']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76009-5c90-401f-bb71-4b22950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '544a1c303ef021f0d54e62a6147c7ae9cd0c84265e302f6da5ed08b616e45b78']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600a-3124-49cb-9777-44ee950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '522ae87e792fd0b2021af0edcdad283505d6258316783c489f37234231b9d6bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600b-2174-44af-8778-4f42950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600c-de54-4db4-a5da-4af1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '58e70e498397acae9b5e84a153e27578ee25e0ee0aca16bcf8a1746423f210f6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600d-2c34-414f-a4f7-4b3c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'e23d689fff3907cbc6f495d1ebaa9c4cdf6f93f9fd26b790f60680dedf489618']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600e-8de0-42ec-ab49-4f2a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '02e1692dbc95bffe12083786208a966bf6b184a428378aabebbd3fee501021c5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7600f-e144-4ce3-8b59-43d7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '758dc6aff09885abf9a6503e4a6473bca83c878f6131acf41290a3c8a5df7cdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76010-22ac-425b-9610-49ed950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'f67356c2bcd99009f1d68806a1214b4108771926e423908d8997cd881277e76e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76011-4ed8-42bf-9227-46dc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'd066c1c5eccfcf64e8398a49ac7efacc9d70a8c8544fb71ba22e0e2f77bff543']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76012-d234-4496-bbb2-42b1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '16b4d65abf95cfb3cedd39b217ff0e4ee2229ae32aeda5170f34c5a3b9c5a0f3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76013-0610-473a-9864-4dfd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '43f2e20933638594c02c83e85bc058b46c308b4f851477e2c0a2a92b4fb1168b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76014-9304-4ab4-aa78-48bb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '2a28c199eeb622fedc9b0b16f65f9a2da113dddd264966a76654546ce70804a4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76015-6b80-4774-bb3d-49f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = '53ca656dd54c14b14ddc758e2160443e1d5d761ffecb37e15216da67fc94c468']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76016-812c-4e53-a941-41b1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"description": "Associated Android Malware Samples",
|
|
"pattern": "[file:hashes.SHA256 = 'b2036d2b31c75684527a8850182363fefbe436dd8f5ccb5e792df2a8535981bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76073-d438-4100-8afb-430e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Documents\\\\Visual Studio 2008\\\\Projects\\\\New folder (2)\\\\kasper\\\\Release\\\\kasper.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76074-9518-40b5-9f43-46fb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Desktop\\\\MergeFiles\\\\Loader v0\\\\Loader\\\\obj\\\\Release\\\\Loader.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76075-e220-4f49-8ab8-41b4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Documents\\\\Visual Studio 2008\\\\Projects\\\\New folder (2)\\\\s7 \u00e2\u20ac\u201c Copy \u00e2\u20ac\u201c Copy 19-2-17\\\\Release\\\\s7.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76077-8530-497a-af29-402f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Documents\\\\Visual Studio 2008\\\\Projects\\\\New folder (2)\\\\s7\\\\Release\\\\s7.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76078-4328-4627-b899-43f0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Desktop\\\\Loader v0\\\\Loader\\\\obj\\\\Release\\\\Loader.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76078-617c-457e-b5bd-4a6a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = 'D:\\\\Merge\\\\Debug\\\\testproj.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76079-f520-47c3-9a9f-4dc6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Documents\\\\Visual Studio 2008\\\\Projects\\\\New folder (2)\\\\kasper \u00e2\u20ac\u201c Copy \u00e2\u20ac\u201c 21-2-17\\\\Release\\\\kasper.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7607a-2144-4ca4-a718-4c2b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:23:04.000Z",
|
|
"modified": "2017-04-07T10:23:04.000Z",
|
|
"pattern": "[file:name = '\\\\%USERPROFILE\\\\%\\\\Desktop\\\\MergeFiles\\\\merge photos\\\\Loader v0\\\\Loader\\\\obj\\\\Release\\\\Loader.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:23:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76985-c430-4b80-9476-456302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:17.000Z",
|
|
"modified": "2017-04-07T10:27:17.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: b2036d2b31c75684527a8850182363fefbe436dd8f5ccb5e792df2a8535981bf",
|
|
"pattern": "[file:hashes.SHA1 = '47b66b0d430c8cc1ad7c5a54e2f39bc0b754742b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76985-8f98-498a-ad4d-4ffb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:17.000Z",
|
|
"modified": "2017-04-07T10:27:17.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: b2036d2b31c75684527a8850182363fefbe436dd8f5ccb5e792df2a8535981bf",
|
|
"pattern": "[file:hashes.MD5 = 'eedbf1f7a0d392d4cea2ad58ed30a72e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76986-8898-4a74-a932-47f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:18.000Z",
|
|
"modified": "2017-04-07T10:27:18.000Z",
|
|
"first_observed": "2017-04-07T10:27:18Z",
|
|
"last_observed": "2017-04-07T10:27:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76986-8898-4a74-a932-47f502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76986-8898-4a74-a932-47f502de0b81",
|
|
"value": "https://www.virustotal.com/file/b2036d2b31c75684527a8850182363fefbe436dd8f5ccb5e792df2a8535981bf/analysis/1491509782/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76987-5208-427c-93a8-4fad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:19.000Z",
|
|
"modified": "2017-04-07T10:27:19.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 53ca656dd54c14b14ddc758e2160443e1d5d761ffecb37e15216da67fc94c468",
|
|
"pattern": "[file:hashes.SHA1 = 'f5d65a42540f73f7d1192dbcceba48fe61500923']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76988-3f14-4b2c-9f52-467002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:20.000Z",
|
|
"modified": "2017-04-07T10:27:20.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 53ca656dd54c14b14ddc758e2160443e1d5d761ffecb37e15216da67fc94c468",
|
|
"pattern": "[file:hashes.MD5 = 'c74703264e464ac0153157d8d257cb29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76989-8a68-47db-95bd-43a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:21.000Z",
|
|
"modified": "2017-04-07T10:27:21.000Z",
|
|
"first_observed": "2017-04-07T10:27:21Z",
|
|
"last_observed": "2017-04-07T10:27:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76989-8a68-47db-95bd-43a302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76989-8a68-47db-95bd-43a302de0b81",
|
|
"value": "https://www.virustotal.com/file/53ca656dd54c14b14ddc758e2160443e1d5d761ffecb37e15216da67fc94c468/analysis/1491514030/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7698a-7934-4832-a419-4ed902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:22.000Z",
|
|
"modified": "2017-04-07T10:27:22.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: d066c1c5eccfcf64e8398a49ac7efacc9d70a8c8544fb71ba22e0e2f77bff543",
|
|
"pattern": "[file:hashes.SHA1 = 'ff675f6862fc4cb474f7e62406b1ad17d4128aef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7698b-813c-4c0c-acb5-4d5902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:23.000Z",
|
|
"modified": "2017-04-07T10:27:23.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: d066c1c5eccfcf64e8398a49ac7efacc9d70a8c8544fb71ba22e0e2f77bff543",
|
|
"pattern": "[file:hashes.MD5 = 'cf89ffc87287673727f57c307a2f329d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e7698b-14a4-483c-9793-425202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:23.000Z",
|
|
"modified": "2017-04-07T10:27:23.000Z",
|
|
"first_observed": "2017-04-07T10:27:23Z",
|
|
"last_observed": "2017-04-07T10:27:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e7698b-14a4-483c-9793-425202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e7698b-14a4-483c-9793-425202de0b81",
|
|
"value": "https://www.virustotal.com/file/d066c1c5eccfcf64e8398a49ac7efacc9d70a8c8544fb71ba22e0e2f77bff543/analysis/1491514028/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7698c-8e64-40b9-852d-4ff402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:24.000Z",
|
|
"modified": "2017-04-07T10:27:24.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: f67356c2bcd99009f1d68806a1214b4108771926e423908d8997cd881277e76e",
|
|
"pattern": "[file:hashes.SHA1 = '97525234d5652367b3f0a81cbcc4131d72455b9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7698d-c938-402e-be81-4f0302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:25.000Z",
|
|
"modified": "2017-04-07T10:27:25.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: f67356c2bcd99009f1d68806a1214b4108771926e423908d8997cd881277e76e",
|
|
"pattern": "[file:hashes.MD5 = '968c1eb13bb073e376f6c3c4e71640be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e7698e-ff84-4f98-b76a-463702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:26.000Z",
|
|
"modified": "2017-04-07T10:27:26.000Z",
|
|
"first_observed": "2017-04-07T10:27:26Z",
|
|
"last_observed": "2017-04-07T10:27:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e7698e-ff84-4f98-b76a-463702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e7698e-ff84-4f98-b76a-463702de0b81",
|
|
"value": "https://www.virustotal.com/file/f67356c2bcd99009f1d68806a1214b4108771926e423908d8997cd881277e76e/analysis/1491509625/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7698f-05c0-417e-94eb-4df402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:27.000Z",
|
|
"modified": "2017-04-07T10:27:27.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 758dc6aff09885abf9a6503e4a6473bca83c878f6131acf41290a3c8a5df7cdb",
|
|
"pattern": "[file:hashes.SHA1 = '52269f57cb246de8815ecdfb3a36ccf69e5ed257']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76990-3144-4ea0-987f-4d1802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:28.000Z",
|
|
"modified": "2017-04-07T10:27:28.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 758dc6aff09885abf9a6503e4a6473bca83c878f6131acf41290a3c8a5df7cdb",
|
|
"pattern": "[file:hashes.MD5 = '5cfc132b66f523b1ce907d9aea1ea199']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76991-bf0c-4520-86b8-465e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:29.000Z",
|
|
"modified": "2017-04-07T10:27:29.000Z",
|
|
"first_observed": "2017-04-07T10:27:29Z",
|
|
"last_observed": "2017-04-07T10:27:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76991-bf0c-4520-86b8-465e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76991-bf0c-4520-86b8-465e02de0b81",
|
|
"value": "https://www.virustotal.com/file/758dc6aff09885abf9a6503e4a6473bca83c878f6131acf41290a3c8a5df7cdb/analysis/1491509603/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76991-095c-4985-83ab-476802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:29.000Z",
|
|
"modified": "2017-04-07T10:27:29.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 02e1692dbc95bffe12083786208a966bf6b184a428378aabebbd3fee501021c5",
|
|
"pattern": "[file:hashes.SHA1 = 'e898f9afb8b11bef066c1c59dd1db1cf654a797b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76992-4c64-471e-85e3-45be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:30.000Z",
|
|
"modified": "2017-04-07T10:27:30.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 02e1692dbc95bffe12083786208a966bf6b184a428378aabebbd3fee501021c5",
|
|
"pattern": "[file:hashes.MD5 = 'ee017b839131d5ee7891e1dd7b163d84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76993-dd28-415c-bc3b-405102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:31.000Z",
|
|
"modified": "2017-04-07T10:27:31.000Z",
|
|
"first_observed": "2017-04-07T10:27:31Z",
|
|
"last_observed": "2017-04-07T10:27:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76993-dd28-415c-bc3b-405102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76993-dd28-415c-bc3b-405102de0b81",
|
|
"value": "https://www.virustotal.com/file/02e1692dbc95bffe12083786208a966bf6b184a428378aabebbd3fee501021c5/analysis/1491483637/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76994-96f8-4d42-a476-45b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:32.000Z",
|
|
"modified": "2017-04-07T10:27:32.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: e23d689fff3907cbc6f495d1ebaa9c4cdf6f93f9fd26b790f60680dedf489618",
|
|
"pattern": "[file:hashes.SHA1 = '78498a78fd3eed0c9a9c16f3a871f9207a3a474f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76995-c17c-4c74-8c88-412702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:33.000Z",
|
|
"modified": "2017-04-07T10:27:33.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: e23d689fff3907cbc6f495d1ebaa9c4cdf6f93f9fd26b790f60680dedf489618",
|
|
"pattern": "[file:hashes.MD5 = '1a602a60afe163a1cf4dae1f82d39e4d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76996-777c-417c-b177-41cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:34.000Z",
|
|
"modified": "2017-04-07T10:27:34.000Z",
|
|
"first_observed": "2017-04-07T10:27:34Z",
|
|
"last_observed": "2017-04-07T10:27:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76996-777c-417c-b177-41cd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76996-777c-417c-b177-41cd02de0b81",
|
|
"value": "https://www.virustotal.com/file/e23d689fff3907cbc6f495d1ebaa9c4cdf6f93f9fd26b790f60680dedf489618/analysis/1491509569/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76997-f444-432a-a39e-45f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:35.000Z",
|
|
"modified": "2017-04-07T10:27:35.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 58e70e498397acae9b5e84a153e27578ee25e0ee0aca16bcf8a1746423f210f6",
|
|
"pattern": "[file:hashes.SHA1 = '4a56b4968f2559459d98ab35a01a6b7b946d6ab8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76998-0ad4-4a96-867d-4af802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:36.000Z",
|
|
"modified": "2017-04-07T10:27:36.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 58e70e498397acae9b5e84a153e27578ee25e0ee0aca16bcf8a1746423f210f6",
|
|
"pattern": "[file:hashes.MD5 = 'ad6ede2e93230802568b59b5bab52bd8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76999-28c8-46a9-8f97-4c9602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:37.000Z",
|
|
"modified": "2017-04-07T10:27:37.000Z",
|
|
"first_observed": "2017-04-07T10:27:37Z",
|
|
"last_observed": "2017-04-07T10:27:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76999-28c8-46a9-8f97-4c9602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76999-28c8-46a9-8f97-4c9602de0b81",
|
|
"value": "https://www.virustotal.com/file/58e70e498397acae9b5e84a153e27578ee25e0ee0aca16bcf8a1746423f210f6/analysis/1491514024/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7699a-fe34-4006-96d8-4a2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:38.000Z",
|
|
"modified": "2017-04-07T10:27:38.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266",
|
|
"pattern": "[file:hashes.SHA1 = '84d5ff14328d71d3fa3c03962734cc7179d2685e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7699b-5be0-4fd9-becc-403202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:39.000Z",
|
|
"modified": "2017-04-07T10:27:39.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266",
|
|
"pattern": "[file:hashes.MD5 = '1feadd0f95d84d878c22534f6ef0bedc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e7699c-f2cc-4a61-9d7d-439a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:40.000Z",
|
|
"modified": "2017-04-07T10:27:40.000Z",
|
|
"first_observed": "2017-04-07T10:27:40Z",
|
|
"last_observed": "2017-04-07T10:27:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e7699c-f2cc-4a61-9d7d-439a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e7699c-f2cc-4a61-9d7d-439a02de0b81",
|
|
"value": "https://www.virustotal.com/file/22078e0d00d6a0f0441b3777e6a418170e3a9e4cce8141f0da8af044fdc1e266/analysis/1490921435/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7699d-c450-45d3-a498-44a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:41.000Z",
|
|
"modified": "2017-04-07T10:27:41.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 522ae87e792fd0b2021af0edcdad283505d6258316783c489f37234231b9d6bf",
|
|
"pattern": "[file:hashes.SHA1 = 'b9f402da8fbed161b1411659a792d08642ac9e61']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7699d-0fec-4005-a24f-4b5402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:41.000Z",
|
|
"modified": "2017-04-07T10:27:41.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 522ae87e792fd0b2021af0edcdad283505d6258316783c489f37234231b9d6bf",
|
|
"pattern": "[file:hashes.MD5 = '34ffb9375de5fb2e5d976316000e561d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e7699e-e220-4811-99d2-4bfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:42.000Z",
|
|
"modified": "2017-04-07T10:27:42.000Z",
|
|
"first_observed": "2017-04-07T10:27:42Z",
|
|
"last_observed": "2017-04-07T10:27:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e7699e-e220-4811-99d2-4bfd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e7699e-e220-4811-99d2-4bfd02de0b81",
|
|
"value": "https://www.virustotal.com/file/522ae87e792fd0b2021af0edcdad283505d6258316783c489f37234231b9d6bf/analysis/1491509499/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e7699f-f014-43c6-b1a6-402302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:43.000Z",
|
|
"modified": "2017-04-07T10:27:43.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 544a1c303ef021f0d54e62a6147c7ae9cd0c84265e302f6da5ed08b616e45b78",
|
|
"pattern": "[file:hashes.SHA1 = '14841dd294bb1207f40d112377387b7d7e240ffe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a0-a590-4fab-873c-430302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:44.000Z",
|
|
"modified": "2017-04-07T10:27:44.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 544a1c303ef021f0d54e62a6147c7ae9cd0c84265e302f6da5ed08b616e45b78",
|
|
"pattern": "[file:hashes.MD5 = '4572eb0381a86916f8e62514ffac0459']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769a1-94a4-455f-b69c-4a9a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:45.000Z",
|
|
"modified": "2017-04-07T10:27:45.000Z",
|
|
"first_observed": "2017-04-07T10:27:45Z",
|
|
"last_observed": "2017-04-07T10:27:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769a1-94a4-455f-b69c-4a9a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769a1-94a4-455f-b69c-4a9a02de0b81",
|
|
"value": "https://www.virustotal.com/file/544a1c303ef021f0d54e62a6147c7ae9cd0c84265e302f6da5ed08b616e45b78/analysis/1491514021/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a2-3ec4-4703-88e6-452502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:46.000Z",
|
|
"modified": "2017-04-07T10:27:46.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 5f3b4eddcc72598721b9ca395d1e5881acbd4fc562e09b688b2d42f65d3a4a93",
|
|
"pattern": "[file:hashes.SHA1 = 'a5ee1f12a50d84d8283e9bfbec1050b989e07e78']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a3-32e0-41e4-a262-421202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:47.000Z",
|
|
"modified": "2017-04-07T10:27:47.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: 5f3b4eddcc72598721b9ca395d1e5881acbd4fc562e09b688b2d42f65d3a4a93",
|
|
"pattern": "[file:hashes.MD5 = 'acc903afe22dcf0eb5f046dcd8db41c1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769a4-da48-413e-8b18-426f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:48.000Z",
|
|
"modified": "2017-04-07T10:27:48.000Z",
|
|
"first_observed": "2017-04-07T10:27:48Z",
|
|
"last_observed": "2017-04-07T10:27:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769a4-da48-413e-8b18-426f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769a4-da48-413e-8b18-426f02de0b81",
|
|
"value": "https://www.virustotal.com/file/5f3b4eddcc72598721b9ca395d1e5881acbd4fc562e09b688b2d42f65d3a4a93/analysis/1490995796/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a5-2970-4c57-ab7c-430902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:49.000Z",
|
|
"modified": "2017-04-07T10:27:49.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: c20438ba8c9e008c1e2eb4343f177757fc260437aeac52df61b156671b07ac14",
|
|
"pattern": "[file:hashes.SHA1 = '0966a7dd1379c07dbdfbf366c3e0920b3f6ff547']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a6-de98-443a-90d0-424302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:50.000Z",
|
|
"modified": "2017-04-07T10:27:50.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: c20438ba8c9e008c1e2eb4343f177757fc260437aeac52df61b156671b07ac14",
|
|
"pattern": "[file:hashes.MD5 = 'cf79d4d6d911e4c864114ddc2faef750']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769a7-673c-404e-87c3-4b9402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:51.000Z",
|
|
"modified": "2017-04-07T10:27:51.000Z",
|
|
"first_observed": "2017-04-07T10:27:51Z",
|
|
"last_observed": "2017-04-07T10:27:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769a7-673c-404e-87c3-4b9402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769a7-673c-404e-87c3-4b9402de0b81",
|
|
"value": "https://www.virustotal.com/file/c20438ba8c9e008c1e2eb4343f177757fc260437aeac52df61b156671b07ac14/analysis/1490944020/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a8-d59c-4412-9dbb-4add02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:52.000Z",
|
|
"modified": "2017-04-07T10:27:52.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: c1564c56c46146db36ec97afd994c45f3621f39c82cc692adba5b9f6d9a62897",
|
|
"pattern": "[file:hashes.SHA1 = '7877661025f315c7d1023c7e124756cab2a3f035']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769a8-08b4-485f-964a-4bcb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:52.000Z",
|
|
"modified": "2017-04-07T10:27:52.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: c1564c56c46146db36ec97afd994c45f3621f39c82cc692adba5b9f6d9a62897",
|
|
"pattern": "[file:hashes.MD5 = '0414afcf37f60c63c280698c840a612d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769a9-2a24-4a46-baee-428002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:53.000Z",
|
|
"modified": "2017-04-07T10:27:53.000Z",
|
|
"first_observed": "2017-04-07T10:27:53Z",
|
|
"last_observed": "2017-04-07T10:27:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769a9-2a24-4a46-baee-428002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769a9-2a24-4a46-baee-428002de0b81",
|
|
"value": "https://www.virustotal.com/file/c1564c56c46146db36ec97afd994c45f3621f39c82cc692adba5b9f6d9a62897/analysis/1491514020/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769aa-aa6c-49e9-a28d-4e7e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:54.000Z",
|
|
"modified": "2017-04-07T10:27:54.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: b6abeffe986eb38e411a4fe956280e2028d8bef699d9dd3244bde721a99b1dee",
|
|
"pattern": "[file:hashes.SHA1 = '9b60a3513dcb53a12e67166ef6f721ad9d194a60']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ab-2fdc-43c2-8a8e-464e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:55.000Z",
|
|
"modified": "2017-04-07T10:27:55.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: b6abeffe986eb38e411a4fe956280e2028d8bef699d9dd3244bde721a99b1dee",
|
|
"pattern": "[file:hashes.MD5 = '1e369cf9d270464352e1cec6e55b56f7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769ac-a7e8-44a8-b91b-4d8f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:56.000Z",
|
|
"modified": "2017-04-07T10:27:56.000Z",
|
|
"first_observed": "2017-04-07T10:27:56Z",
|
|
"last_observed": "2017-04-07T10:27:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769ac-a7e8-44a8-b91b-4d8f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769ac-a7e8-44a8-b91b-4d8f02de0b81",
|
|
"value": "https://www.virustotal.com/file/b6abeffe986eb38e411a4fe956280e2028d8bef699d9dd3244bde721a99b1dee/analysis/1490993923/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ad-21f0-4743-a2b8-4e3202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:57.000Z",
|
|
"modified": "2017-04-07T10:27:57.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: d909669b000c479b8bdd9f86fa62879a7c8b4dca8cde4f4a404862a4604c52e2",
|
|
"pattern": "[file:hashes.SHA1 = 'eb74141a99dc5d9d203cd9effcb42139c63d56e7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ae-a9e8-4414-aa4f-4ce902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:58.000Z",
|
|
"modified": "2017-04-07T10:27:58.000Z",
|
|
"description": "Associated Android Malware Samples - Xchecked via VT: d909669b000c479b8bdd9f86fa62879a7c8b4dca8cde4f4a404862a4604c52e2",
|
|
"pattern": "[file:hashes.MD5 = 'c945ef969a544b020c681ac25d591867']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:27:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769af-d1dc-430a-87e4-4f1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:27:59.000Z",
|
|
"modified": "2017-04-07T10:27:59.000Z",
|
|
"first_observed": "2017-04-07T10:27:59Z",
|
|
"last_observed": "2017-04-07T10:27:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769af-d1dc-430a-87e4-4f1d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769af-d1dc-430a-87e4-4f1d02de0b81",
|
|
"value": "https://www.virustotal.com/file/d909669b000c479b8bdd9f86fa62879a7c8b4dca8cde4f4a404862a4604c52e2/analysis/1491509414/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b0-7b3c-4cb9-b10e-430c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:00.000Z",
|
|
"modified": "2017-04-07T10:28:00.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0e7507e955dfe8027ed5740400dda772c403510f75d066baf0077ca1ab478048",
|
|
"pattern": "[file:hashes.SHA1 = 'f8e2da48135151b9f14f81ec8a84ad3f5567c4df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b1-2814-43f4-9a37-44ea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:01.000Z",
|
|
"modified": "2017-04-07T10:28:01.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0e7507e955dfe8027ed5740400dda772c403510f75d066baf0077ca1ab478048",
|
|
"pattern": "[file:hashes.MD5 = '55dc61056837ec8829c0f3c8e85cb7b3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769b1-0bf0-4d79-897a-4de002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:01.000Z",
|
|
"modified": "2017-04-07T10:28:01.000Z",
|
|
"first_observed": "2017-04-07T10:28:01Z",
|
|
"last_observed": "2017-04-07T10:28:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769b1-0bf0-4d79-897a-4de002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769b1-0bf0-4d79-897a-4de002de0b81",
|
|
"value": "https://www.virustotal.com/file/0e7507e955dfe8027ed5740400dda772c403510f75d066baf0077ca1ab478048/analysis/1491514019/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b2-ba04-4086-b2f4-467902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:02.000Z",
|
|
"modified": "2017-04-07T10:28:02.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d63da6f863609c87cf283cd6da7c325f9622bff986b05c47e106855a514da4b6",
|
|
"pattern": "[file:hashes.SHA1 = '0b7f02ef8f07de6a5b54dcf2b253e40e83b830fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b3-9cb4-45de-9160-422f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:03.000Z",
|
|
"modified": "2017-04-07T10:28:03.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d63da6f863609c87cf283cd6da7c325f9622bff986b05c47e106855a514da4b6",
|
|
"pattern": "[file:hashes.MD5 = '6f42e0522b807d2b90aaf050a7be7f44']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769b4-e31c-4303-b9c1-4e6f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:04.000Z",
|
|
"modified": "2017-04-07T10:28:04.000Z",
|
|
"first_observed": "2017-04-07T10:28:04Z",
|
|
"last_observed": "2017-04-07T10:28:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769b4-e31c-4303-b9c1-4e6f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769b4-e31c-4303-b9c1-4e6f02de0b81",
|
|
"value": "https://www.virustotal.com/file/d63da6f863609c87cf283cd6da7c325f9622bff986b05c47e106855a514da4b6/analysis/1491514019/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b5-7bec-4058-bfdb-410c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:05.000Z",
|
|
"modified": "2017-04-07T10:28:05.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 3fce85b9c279d94dd7018a656027a496b4b5df719933630d7375c42ac088dd87",
|
|
"pattern": "[file:hashes.SHA1 = 'cc861170b301a07d81d3ce4fe5fd275cfabe8388']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b6-3fac-4f80-8ac9-45df02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:06.000Z",
|
|
"modified": "2017-04-07T10:28:06.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 3fce85b9c279d94dd7018a656027a496b4b5df719933630d7375c42ac088dd87",
|
|
"pattern": "[file:hashes.MD5 = 'd97819d9bcfd51df406a105c73abe943']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769b7-c318-4cca-b93a-462d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:07.000Z",
|
|
"modified": "2017-04-07T10:28:07.000Z",
|
|
"first_observed": "2017-04-07T10:28:07Z",
|
|
"last_observed": "2017-04-07T10:28:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769b7-c318-4cca-b93a-462d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769b7-c318-4cca-b93a-462d02de0b81",
|
|
"value": "https://www.virustotal.com/file/3fce85b9c279d94dd7018a656027a496b4b5df719933630d7375c42ac088dd87/analysis/1491508417/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b8-4d08-4306-b5a7-461802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:08.000Z",
|
|
"modified": "2017-04-07T10:28:08.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b679878e940eaee79436a895aa4f43e32416c3ad2fbfeb812fc39022c84b82d9",
|
|
"pattern": "[file:hashes.SHA1 = '438f08d763f356176ec688b09359a18f0ce21e0b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769b9-2524-4b29-a4c5-4a2302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:09.000Z",
|
|
"modified": "2017-04-07T10:28:09.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b679878e940eaee79436a895aa4f43e32416c3ad2fbfeb812fc39022c84b82d9",
|
|
"pattern": "[file:hashes.MD5 = '2c74dfe9b135414b26a16b1da524212a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769ba-e080-4c93-a6c5-45fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:10.000Z",
|
|
"modified": "2017-04-07T10:28:10.000Z",
|
|
"first_observed": "2017-04-07T10:28:10Z",
|
|
"last_observed": "2017-04-07T10:28:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769ba-e080-4c93-a6c5-45fc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769ba-e080-4c93-a6c5-45fc02de0b81",
|
|
"value": "https://www.virustotal.com/file/b679878e940eaee79436a895aa4f43e32416c3ad2fbfeb812fc39022c84b82d9/analysis/1491508341/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ba-7964-472b-a87e-42c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:10.000Z",
|
|
"modified": "2017-04-07T10:28:10.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 75a708bf42ac01d857ecb3bff18c633e334329d4b89ae4201a989f564a2410b6",
|
|
"pattern": "[file:hashes.SHA1 = '223e1ffbf2641d8934c8b568755235806896e02e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769bb-ce40-4a9d-bd9f-4f4e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:11.000Z",
|
|
"modified": "2017-04-07T10:28:11.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 75a708bf42ac01d857ecb3bff18c633e334329d4b89ae4201a989f564a2410b6",
|
|
"pattern": "[file:hashes.MD5 = '650ea6fafd903eb1f733f6969ce285db']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769bc-b868-4f1e-95ee-41f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:12.000Z",
|
|
"modified": "2017-04-07T10:28:12.000Z",
|
|
"first_observed": "2017-04-07T10:28:12Z",
|
|
"last_observed": "2017-04-07T10:28:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769bc-b868-4f1e-95ee-41f502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769bc-b868-4f1e-95ee-41f502de0b81",
|
|
"value": "https://www.virustotal.com/file/75a708bf42ac01d857ecb3bff18c633e334329d4b89ae4201a989f564a2410b6/analysis/1491514018/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769bd-5a04-4469-bd17-448102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:13.000Z",
|
|
"modified": "2017-04-07T10:28:13.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b22b98b8d50aab1b0bea0e458e0736940215365752797de892745bafda5d9ce9",
|
|
"pattern": "[file:hashes.SHA1 = 'b9ce2c94a04508257b4775e00f14538fcc5726ea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769be-fcec-4bca-a7a1-4b5e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:14.000Z",
|
|
"modified": "2017-04-07T10:28:14.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b22b98b8d50aab1b0bea0e458e0736940215365752797de892745bafda5d9ce9",
|
|
"pattern": "[file:hashes.MD5 = '5ae2b492adabd26f8993eb7882f3e0d4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769bf-0564-494c-bd28-474f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:15.000Z",
|
|
"modified": "2017-04-07T10:28:15.000Z",
|
|
"first_observed": "2017-04-07T10:28:15Z",
|
|
"last_observed": "2017-04-07T10:28:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769bf-0564-494c-bd28-474f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769bf-0564-494c-bd28-474f02de0b81",
|
|
"value": "https://www.virustotal.com/file/b22b98b8d50aab1b0bea0e458e0736940215365752797de892745bafda5d9ce9/analysis/1491508252/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c0-a22c-47ac-8d8e-418302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:16.000Z",
|
|
"modified": "2017-04-07T10:28:16.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b033de3c20701482bd375ea6e45ecae38295de72336a5f96f4ab994e6cef212a",
|
|
"pattern": "[file:hashes.SHA1 = 'd71b466869391f331e49e3a2dabbe0983cdb267b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c1-bf54-426e-9ec1-44f302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:17.000Z",
|
|
"modified": "2017-04-07T10:28:17.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b033de3c20701482bd375ea6e45ecae38295de72336a5f96f4ab994e6cef212a",
|
|
"pattern": "[file:hashes.MD5 = '7472cec8eff3d46a95c6446cee42664a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769c2-b4d4-4bd3-a073-460402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:18.000Z",
|
|
"modified": "2017-04-07T10:28:18.000Z",
|
|
"first_observed": "2017-04-07T10:28:18Z",
|
|
"last_observed": "2017-04-07T10:28:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769c2-b4d4-4bd3-a073-460402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769c2-b4d4-4bd3-a073-460402de0b81",
|
|
"value": "https://www.virustotal.com/file/b033de3c20701482bd375ea6e45ecae38295de72336a5f96f4ab994e6cef212a/analysis/1491514018/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c3-e568-49f9-abde-464302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:19.000Z",
|
|
"modified": "2017-04-07T10:28:19.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7d4e98f9136c4c7952e3acbb328ad06e522718ad4d05bcd04eeb225335e75631",
|
|
"pattern": "[file:hashes.SHA1 = '75898e1ef2983ee349953b305634bda4053fb470']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c4-8918-49d4-b1e8-4f8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:20.000Z",
|
|
"modified": "2017-04-07T10:28:20.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7d4e98f9136c4c7952e3acbb328ad06e522718ad4d05bcd04eeb225335e75631",
|
|
"pattern": "[file:hashes.MD5 = 'f8f5b9d839be111797336f095c5155e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769c5-5994-4597-9d9c-406302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:21.000Z",
|
|
"modified": "2017-04-07T10:28:21.000Z",
|
|
"first_observed": "2017-04-07T10:28:21Z",
|
|
"last_observed": "2017-04-07T10:28:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769c5-5994-4597-9d9c-406302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769c5-5994-4597-9d9c-406302de0b81",
|
|
"value": "https://www.virustotal.com/file/7d4e98f9136c4c7952e3acbb328ad06e522718ad4d05bcd04eeb225335e75631/analysis/1491514017/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c6-0754-4a30-881f-497c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:22.000Z",
|
|
"modified": "2017-04-07T10:28:22.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 027b0d9ee5258bb18c824be1b6aff33aeb3060ca3e577f2f8fff06ed4854883d",
|
|
"pattern": "[file:hashes.SHA1 = '9affce7807011fde13d65811fdc326d063f3fe70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c7-3f74-4340-9dca-42c502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:23.000Z",
|
|
"modified": "2017-04-07T10:28:23.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 027b0d9ee5258bb18c824be1b6aff33aeb3060ca3e577f2f8fff06ed4854883d",
|
|
"pattern": "[file:hashes.MD5 = '3b3e19eb59b1c0e0f1849a9c94ce87c7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769c8-63d4-454f-87be-409e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:24.000Z",
|
|
"modified": "2017-04-07T10:28:24.000Z",
|
|
"first_observed": "2017-04-07T10:28:24Z",
|
|
"last_observed": "2017-04-07T10:28:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769c8-63d4-454f-87be-409e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769c8-63d4-454f-87be-409e02de0b81",
|
|
"value": "https://www.virustotal.com/file/027b0d9ee5258bb18c824be1b6aff33aeb3060ca3e577f2f8fff06ed4854883d/analysis/1491514017/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769c9-bad4-4512-98b1-4b1b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:25.000Z",
|
|
"modified": "2017-04-07T10:28:25.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e73381e591dd8538641236530bda5bc0daa014e3486b11a4da820657b48db9f9",
|
|
"pattern": "[file:hashes.SHA1 = '043a047c47fb8b7866ff41694e99b8d1486cf41f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ca-fb9c-4de3-9073-470602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:26.000Z",
|
|
"modified": "2017-04-07T10:28:26.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e73381e591dd8538641236530bda5bc0daa014e3486b11a4da820657b48db9f9",
|
|
"pattern": "[file:hashes.MD5 = 'b6c65ddb88b9ebf4e5de37d802daa61b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769cb-8f2c-459e-9963-4eae02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:27.000Z",
|
|
"modified": "2017-04-07T10:28:27.000Z",
|
|
"first_observed": "2017-04-07T10:28:27Z",
|
|
"last_observed": "2017-04-07T10:28:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769cb-8f2c-459e-9963-4eae02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769cb-8f2c-459e-9963-4eae02de0b81",
|
|
"value": "https://www.virustotal.com/file/e73381e591dd8538641236530bda5bc0daa014e3486b11a4da820657b48db9f9/analysis/1460486999/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769cc-4524-4d30-8f6d-4ed502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:28.000Z",
|
|
"modified": "2017-04-07T10:28:28.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 06a69598b2251200cbdf51c53be45ad90240fd69502063aa4afa5b1086fc34b3",
|
|
"pattern": "[file:hashes.SHA1 = 'f71e5b02347452ee88f2689052ff3c9e7dd895df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769cd-61a4-499b-b60e-42f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:29.000Z",
|
|
"modified": "2017-04-07T10:28:29.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 06a69598b2251200cbdf51c53be45ad90240fd69502063aa4afa5b1086fc34b3",
|
|
"pattern": "[file:hashes.MD5 = '7af2778d0c5d2b01ebbb928cdd2c4579']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769ce-6790-4468-86f3-478002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:30.000Z",
|
|
"modified": "2017-04-07T10:28:30.000Z",
|
|
"first_observed": "2017-04-07T10:28:30Z",
|
|
"last_observed": "2017-04-07T10:28:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769ce-6790-4468-86f3-478002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769ce-6790-4468-86f3-478002de0b81",
|
|
"value": "https://www.virustotal.com/file/06a69598b2251200cbdf51c53be45ad90240fd69502063aa4afa5b1086fc34b3/analysis/1491514017/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769cf-2cb4-40b5-ab48-454902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:31.000Z",
|
|
"modified": "2017-04-07T10:28:31.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 77dc371fcdcaae8f38e942e9084855d62f2daf81460c33f2ea64c77a470f8c8c",
|
|
"pattern": "[file:hashes.SHA1 = 'd9136052f8c48242c2efd18453480e46633ebec4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d0-0b24-40a0-bc2b-4d6802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:32.000Z",
|
|
"modified": "2017-04-07T10:28:32.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 77dc371fcdcaae8f38e942e9084855d62f2daf81460c33f2ea64c77a470f8c8c",
|
|
"pattern": "[file:hashes.MD5 = 'bf1c8ff4541075312d7c2eef667510e4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769d1-2c58-4e1e-b2e7-40b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:33.000Z",
|
|
"modified": "2017-04-07T10:28:33.000Z",
|
|
"first_observed": "2017-04-07T10:28:33Z",
|
|
"last_observed": "2017-04-07T10:28:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769d1-2c58-4e1e-b2e7-40b902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769d1-2c58-4e1e-b2e7-40b902de0b81",
|
|
"value": "https://www.virustotal.com/file/77dc371fcdcaae8f38e942e9084855d62f2daf81460c33f2ea64c77a470f8c8c/analysis/1491514017/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d3-d8d8-41e2-889e-4ff402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:35.000Z",
|
|
"modified": "2017-04-07T10:28:35.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7f02e8bece61a3fa6400e9dcbb0972a136b1818bf1629afe4456819beb04b4cf",
|
|
"pattern": "[file:hashes.SHA1 = 'a1e17d667c4dcb337e7a65ab369753876b65ba8b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d3-c408-4aba-9311-40ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:35.000Z",
|
|
"modified": "2017-04-07T10:28:35.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7f02e8bece61a3fa6400e9dcbb0972a136b1818bf1629afe4456819beb04b4cf",
|
|
"pattern": "[file:hashes.MD5 = 'c8df50c71ef03450ed3b65b773266185']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769d4-8dc8-49f3-9e32-4e2902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:36.000Z",
|
|
"modified": "2017-04-07T10:28:36.000Z",
|
|
"first_observed": "2017-04-07T10:28:36Z",
|
|
"last_observed": "2017-04-07T10:28:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769d4-8dc8-49f3-9e32-4e2902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769d4-8dc8-49f3-9e32-4e2902de0b81",
|
|
"value": "https://www.virustotal.com/file/7f02e8bece61a3fa6400e9dcbb0972a136b1818bf1629afe4456819beb04b4cf/analysis/1491508183/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d5-b23c-4893-ac35-4ba802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:37.000Z",
|
|
"modified": "2017-04-07T10:28:37.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2f40c95693d1c0b0aa8195a7b943b935634745a1aae3ea91752ca4a535e69007",
|
|
"pattern": "[file:hashes.SHA1 = 'd465ce72bcdbf7f3ab6abc8dac4935fbb2321fd8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d6-8c84-498b-a78e-493802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:38.000Z",
|
|
"modified": "2017-04-07T10:28:38.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2f40c95693d1c0b0aa8195a7b943b935634745a1aae3ea91752ca4a535e69007",
|
|
"pattern": "[file:hashes.MD5 = '0513cc7750a207fdb62b2ecf655a32bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769d7-fbd8-46e1-af8e-430102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:39.000Z",
|
|
"modified": "2017-04-07T10:28:39.000Z",
|
|
"first_observed": "2017-04-07T10:28:39Z",
|
|
"last_observed": "2017-04-07T10:28:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769d7-fbd8-46e1-af8e-430102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769d7-fbd8-46e1-af8e-430102de0b81",
|
|
"value": "https://www.virustotal.com/file/2f40c95693d1c0b0aa8195a7b943b935634745a1aae3ea91752ca4a535e69007/analysis/1491514016/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769d9-4e20-437c-887d-47b302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:41.000Z",
|
|
"modified": "2017-04-07T10:28:41.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0d94f4aaebcdcfaf5b377af33da42e69b453297cf6b90387db95868a48c172bc",
|
|
"pattern": "[file:hashes.SHA1 = '0ad7e40a970854a0f2908bdf478a63bbb73f9a63']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769da-1684-41b6-ae88-4bca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:42.000Z",
|
|
"modified": "2017-04-07T10:28:42.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0d94f4aaebcdcfaf5b377af33da42e69b453297cf6b90387db95868a48c172bc",
|
|
"pattern": "[file:hashes.MD5 = '877b69d3a4a1107bed3de216d63097e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769db-fc08-43c6-b902-401902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:43.000Z",
|
|
"modified": "2017-04-07T10:28:43.000Z",
|
|
"first_observed": "2017-04-07T10:28:43Z",
|
|
"last_observed": "2017-04-07T10:28:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769db-fc08-43c6-b902-401902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769db-fc08-43c6-b902-401902de0b81",
|
|
"value": "https://www.virustotal.com/file/0d94f4aaebcdcfaf5b377af33da42e69b453297cf6b90387db95868a48c172bc/analysis/1491514016/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769dc-e490-4595-bcc7-479a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:44.000Z",
|
|
"modified": "2017-04-07T10:28:44.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 582cd41417aeb2f3f86d2c9fb7f8add4e5edacfed7cae0aecc8cb088a823d240",
|
|
"pattern": "[file:hashes.SHA1 = '90d64870162f34c53912d5b12a9f17fa649e9a98']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769dd-6be8-4a75-be30-436802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:45.000Z",
|
|
"modified": "2017-04-07T10:28:45.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 582cd41417aeb2f3f86d2c9fb7f8add4e5edacfed7cae0aecc8cb088a823d240",
|
|
"pattern": "[file:hashes.MD5 = '30265105f1efc626e0b6eab9e5ba4292']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769de-c308-4c07-8eec-453a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:46.000Z",
|
|
"modified": "2017-04-07T10:28:46.000Z",
|
|
"first_observed": "2017-04-07T10:28:46Z",
|
|
"last_observed": "2017-04-07T10:28:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769de-c308-4c07-8eec-453a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769de-c308-4c07-8eec-453a02de0b81",
|
|
"value": "https://www.virustotal.com/file/582cd41417aeb2f3f86d2c9fb7f8add4e5edacfed7cae0aecc8cb088a823d240/analysis/1491508080/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769df-f364-4190-98b0-414b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:47.000Z",
|
|
"modified": "2017-04-07T10:28:47.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a5daa9cf58a2f6bf3f39ae022b0c87458b3ade2d4a006e5489f2417ff639e011",
|
|
"pattern": "[file:hashes.SHA1 = '9b6e18ce201bc3d9377ed44e8c2ed9ef1b507313']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769df-4a40-4c43-8382-4b1b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:47.000Z",
|
|
"modified": "2017-04-07T10:28:47.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a5daa9cf58a2f6bf3f39ae022b0c87458b3ade2d4a006e5489f2417ff639e011",
|
|
"pattern": "[file:hashes.MD5 = '3b909498cf8f87767c7c0437ba5214d3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769e1-fa78-4eb5-8787-469202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:49.000Z",
|
|
"modified": "2017-04-07T10:28:49.000Z",
|
|
"first_observed": "2017-04-07T10:28:49Z",
|
|
"last_observed": "2017-04-07T10:28:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769e1-fa78-4eb5-8787-469202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769e1-fa78-4eb5-8787-469202de0b81",
|
|
"value": "https://www.virustotal.com/file/a5daa9cf58a2f6bf3f39ae022b0c87458b3ade2d4a006e5489f2417ff639e011/analysis/1491507941/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e1-6110-476c-a086-4c0502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:49.000Z",
|
|
"modified": "2017-04-07T10:28:49.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8cf8d06d2935153d3c8d570ecd5990432bb4933ca89845bc2cd763b40ba7edb4",
|
|
"pattern": "[file:hashes.SHA1 = 'a3d6e3dc4f0bcc3ee9c6df2e628e2a26759ecdbd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e2-f088-42ec-b603-406902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:50.000Z",
|
|
"modified": "2017-04-07T10:28:50.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8cf8d06d2935153d3c8d570ecd5990432bb4933ca89845bc2cd763b40ba7edb4",
|
|
"pattern": "[file:hashes.MD5 = '69d1cceb045ff819111a624326340602']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769e3-c4b8-48d6-be75-411b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:51.000Z",
|
|
"modified": "2017-04-07T10:28:51.000Z",
|
|
"first_observed": "2017-04-07T10:28:51Z",
|
|
"last_observed": "2017-04-07T10:28:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769e3-c4b8-48d6-be75-411b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769e3-c4b8-48d6-be75-411b02de0b81",
|
|
"value": "https://www.virustotal.com/file/8cf8d06d2935153d3c8d570ecd5990432bb4933ca89845bc2cd763b40ba7edb4/analysis/1491507808/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e4-c020-4c12-bdde-471c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:52.000Z",
|
|
"modified": "2017-04-07T10:28:52.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 14b34347a75bc46ee69e1782cb658f7f404487a8fc40b973649d53d008bc0e75",
|
|
"pattern": "[file:hashes.SHA1 = 'dcd30bf75aca77db4fb8a918eb73d9b5a1b844f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e5-d768-43d0-a302-433e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:53.000Z",
|
|
"modified": "2017-04-07T10:28:53.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 14b34347a75bc46ee69e1782cb658f7f404487a8fc40b973649d53d008bc0e75",
|
|
"pattern": "[file:hashes.MD5 = '1dc2a1a323f6745d3bfd8ef12aea5c2c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769e6-822c-4cdf-bf63-41cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:54.000Z",
|
|
"modified": "2017-04-07T10:28:54.000Z",
|
|
"first_observed": "2017-04-07T10:28:54Z",
|
|
"last_observed": "2017-04-07T10:28:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769e6-822c-4cdf-bf63-41cd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769e6-822c-4cdf-bf63-41cd02de0b81",
|
|
"value": "https://www.virustotal.com/file/14b34347a75bc46ee69e1782cb658f7f404487a8fc40b973649d53d008bc0e75/analysis/1491507738/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e7-d9fc-4ada-9b8f-43cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:55.000Z",
|
|
"modified": "2017-04-07T10:28:55.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1a4d7b935cb365f75a3f33c6490023aad054facf55a1411cd7b9d723eb99cf53",
|
|
"pattern": "[file:hashes.SHA1 = 'b9acca31880272a5a1de4272d31d208e532f517e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769e8-e7f8-4483-8c01-4ba802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:56.000Z",
|
|
"modified": "2017-04-07T10:28:56.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1a4d7b935cb365f75a3f33c6490023aad054facf55a1411cd7b9d723eb99cf53",
|
|
"pattern": "[file:hashes.MD5 = '9e5cbd13cf51b95040fa1d4a8369b3df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769e9-f7dc-42c8-9673-446902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:57.000Z",
|
|
"modified": "2017-04-07T10:28:57.000Z",
|
|
"first_observed": "2017-04-07T10:28:57Z",
|
|
"last_observed": "2017-04-07T10:28:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769e9-f7dc-42c8-9673-446902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769e9-f7dc-42c8-9673-446902de0b81",
|
|
"value": "https://www.virustotal.com/file/1a4d7b935cb365f75a3f33c6490023aad054facf55a1411cd7b9d723eb99cf53/analysis/1491514014/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ea-41a4-4cbf-bcfb-419602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:58.000Z",
|
|
"modified": "2017-04-07T10:28:58.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 699f4f0513de49db7dafa3760daa3c27ca9cd12e216ff3e042966212870bb906",
|
|
"pattern": "[file:hashes.SHA1 = 'fede8c68693facc1bd0d42f7219a76559f72bdc1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769eb-2784-4d3d-9e4a-49ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:28:59.000Z",
|
|
"modified": "2017-04-07T10:28:59.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 699f4f0513de49db7dafa3760daa3c27ca9cd12e216ff3e042966212870bb906",
|
|
"pattern": "[file:hashes.MD5 = 'be99a259abdd09eaf5ccdf1ff4fd0a84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:28:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769ec-dc98-4b75-ac9e-4d6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:00.000Z",
|
|
"modified": "2017-04-07T10:29:00.000Z",
|
|
"first_observed": "2017-04-07T10:29:00Z",
|
|
"last_observed": "2017-04-07T10:29:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769ec-dc98-4b75-ac9e-4d6d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769ec-dc98-4b75-ac9e-4d6d02de0b81",
|
|
"value": "https://www.virustotal.com/file/699f4f0513de49db7dafa3760daa3c27ca9cd12e216ff3e042966212870bb906/analysis/1491507652/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ed-787c-425a-9007-4a9f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:01.000Z",
|
|
"modified": "2017-04-07T10:29:01.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 9a32cc01c4e6120cec03aba783087df35724d5b1feb3f75fa0b78963e8cc7735",
|
|
"pattern": "[file:hashes.SHA1 = 'bc1c09e98d6acaf53613daaa3248feb9d3172c83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ee-b490-4a87-9b06-4f4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:02.000Z",
|
|
"modified": "2017-04-07T10:29:02.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 9a32cc01c4e6120cec03aba783087df35724d5b1feb3f75fa0b78963e8cc7735",
|
|
"pattern": "[file:hashes.MD5 = '4012afd54ecb4b4e01f524a9f1d11a09']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769ef-ed94-498a-a169-4a7902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:03.000Z",
|
|
"modified": "2017-04-07T10:29:03.000Z",
|
|
"first_observed": "2017-04-07T10:29:03Z",
|
|
"last_observed": "2017-04-07T10:29:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769ef-ed94-498a-a169-4a7902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769ef-ed94-498a-a169-4a7902de0b81",
|
|
"value": "https://www.virustotal.com/file/9a32cc01c4e6120cec03aba783087df35724d5b1feb3f75fa0b78963e8cc7735/analysis/1491507584/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f0-43a0-48cf-878d-490d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:04.000Z",
|
|
"modified": "2017-04-07T10:29:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d1bbde1ddd5bb1b421f230ba2213013b098f2abe3ac526be142371e2728ba40f",
|
|
"pattern": "[file:hashes.SHA1 = '677e00ab7257c2b5731c9b147bdab19265534596']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f0-8bc0-4833-a010-47e402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:04.000Z",
|
|
"modified": "2017-04-07T10:29:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d1bbde1ddd5bb1b421f230ba2213013b098f2abe3ac526be142371e2728ba40f",
|
|
"pattern": "[file:hashes.MD5 = 'fe3f29aff51dc9673bc30f85c0005f64']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769f1-0b7c-46db-8125-41a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:05.000Z",
|
|
"modified": "2017-04-07T10:29:05.000Z",
|
|
"first_observed": "2017-04-07T10:29:05Z",
|
|
"last_observed": "2017-04-07T10:29:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769f1-0b7c-46db-8125-41a002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769f1-0b7c-46db-8125-41a002de0b81",
|
|
"value": "https://www.virustotal.com/file/d1bbde1ddd5bb1b421f230ba2213013b098f2abe3ac526be142371e2728ba40f/analysis/1491514013/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f2-c0c8-434a-ace3-406102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:06.000Z",
|
|
"modified": "2017-04-07T10:29:06.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 76573e0c213dbdba3283887eee7418f2b0c0ce6506145567547319bec8f0d6a6",
|
|
"pattern": "[file:hashes.SHA1 = 'ebea57a654084fe1a9586057bd83b83147dcab82']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f3-eaa4-416b-a6d1-41ac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:07.000Z",
|
|
"modified": "2017-04-07T10:29:07.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 76573e0c213dbdba3283887eee7418f2b0c0ce6506145567547319bec8f0d6a6",
|
|
"pattern": "[file:hashes.MD5 = '2663a331a4c0e0360b7c7834cf7d2138']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769f4-2cf8-43f1-98fe-449102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:08.000Z",
|
|
"modified": "2017-04-07T10:29:08.000Z",
|
|
"first_observed": "2017-04-07T10:29:08Z",
|
|
"last_observed": "2017-04-07T10:29:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769f4-2cf8-43f1-98fe-449102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769f4-2cf8-43f1-98fe-449102de0b81",
|
|
"value": "https://www.virustotal.com/file/76573e0c213dbdba3283887eee7418f2b0c0ce6506145567547319bec8f0d6a6/analysis/1491514012/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f5-ffbc-45b9-936e-4bee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:09.000Z",
|
|
"modified": "2017-04-07T10:29:09.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6b676728f3206db8aa7ae57d8ee0747f2919a64ab8157b28bd1add0c15d2bb59",
|
|
"pattern": "[file:hashes.SHA1 = 'fa8a438aec011e6a605a21f4fa8c5a28c927c38b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f6-736c-41e1-9f38-4c7b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:10.000Z",
|
|
"modified": "2017-04-07T10:29:10.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6b676728f3206db8aa7ae57d8ee0747f2919a64ab8157b28bd1add0c15d2bb59",
|
|
"pattern": "[file:hashes.MD5 = '90b4fbd59d799a9ea9410881d1a72e80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769f7-3900-458c-86ca-45d202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:11.000Z",
|
|
"modified": "2017-04-07T10:29:11.000Z",
|
|
"first_observed": "2017-04-07T10:29:11Z",
|
|
"last_observed": "2017-04-07T10:29:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769f7-3900-458c-86ca-45d202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769f7-3900-458c-86ca-45d202de0b81",
|
|
"value": "https://www.virustotal.com/file/6b676728f3206db8aa7ae57d8ee0747f2919a64ab8157b28bd1add0c15d2bb59/analysis/1491514012/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f8-6c14-44ac-9bfb-4c8d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:12.000Z",
|
|
"modified": "2017-04-07T10:29:12.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 876919233b24808b457fe83c815a4e6b30e415771bb6fe2e68a5cdae8e9a6c6c",
|
|
"pattern": "[file:hashes.SHA1 = 'a7acfa386589daa7e7090e3ddbce6c61e8c2c3ae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769f9-73b0-4d94-99f8-441c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:13.000Z",
|
|
"modified": "2017-04-07T10:29:13.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 876919233b24808b457fe83c815a4e6b30e415771bb6fe2e68a5cdae8e9a6c6c",
|
|
"pattern": "[file:hashes.MD5 = '30be94c1b6444deca5e1944cae7af009']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769fa-0590-4063-878f-438702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:14.000Z",
|
|
"modified": "2017-04-07T10:29:14.000Z",
|
|
"first_observed": "2017-04-07T10:29:14Z",
|
|
"last_observed": "2017-04-07T10:29:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769fa-0590-4063-878f-438702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769fa-0590-4063-878f-438702de0b81",
|
|
"value": "https://www.virustotal.com/file/876919233b24808b457fe83c815a4e6b30e415771bb6fe2e68a5cdae8e9a6c6c/analysis/1491507527/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769fc-cbd4-47f1-9208-44a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:16.000Z",
|
|
"modified": "2017-04-07T10:29:16.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 425d427828205811258e22cd04eb9acb4e497590eecefed77cdb9252b3e45fcb",
|
|
"pattern": "[file:hashes.SHA1 = 'c3bccd471951646fa3e882ca8123d3872df0dec6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769fd-eb58-4c50-842b-424702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:17.000Z",
|
|
"modified": "2017-04-07T10:29:17.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 425d427828205811258e22cd04eb9acb4e497590eecefed77cdb9252b3e45fcb",
|
|
"pattern": "[file:hashes.MD5 = '09e3f6439205672bb41911b20f685305']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e769fd-ac68-477d-89c4-465d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:17.000Z",
|
|
"modified": "2017-04-07T10:29:17.000Z",
|
|
"first_observed": "2017-04-07T10:29:17Z",
|
|
"last_observed": "2017-04-07T10:29:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e769fd-ac68-477d-89c4-465d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e769fd-ac68-477d-89c4-465d02de0b81",
|
|
"value": "https://www.virustotal.com/file/425d427828205811258e22cd04eb9acb4e497590eecefed77cdb9252b3e45fcb/analysis/1491537869/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769fe-3ea4-4e3b-964f-492502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:18.000Z",
|
|
"modified": "2017-04-07T10:29:18.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e8ab81ee03aca399d8e4e3f6ca9d6e98c7c75e68f22e12d6213c15d8b9cc3ace",
|
|
"pattern": "[file:hashes.SHA1 = 'c23bffee3059805fadc5971c89f0eb8500c0f4c6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e769ff-ea38-4296-b3d8-4b0b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:19.000Z",
|
|
"modified": "2017-04-07T10:29:19.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e8ab81ee03aca399d8e4e3f6ca9d6e98c7c75e68f22e12d6213c15d8b9cc3ace",
|
|
"pattern": "[file:hashes.MD5 = '1f1108963c01115b8baffb6535b36a5c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a00-c060-43e1-8cd0-4e9d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:20.000Z",
|
|
"modified": "2017-04-07T10:29:20.000Z",
|
|
"first_observed": "2017-04-07T10:29:20Z",
|
|
"last_observed": "2017-04-07T10:29:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a00-c060-43e1-8cd0-4e9d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a00-c060-43e1-8cd0-4e9d02de0b81",
|
|
"value": "https://www.virustotal.com/file/e8ab81ee03aca399d8e4e3f6ca9d6e98c7c75e68f22e12d6213c15d8b9cc3ace/analysis/1491507454/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a01-478c-44d9-88c1-40c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:21.000Z",
|
|
"modified": "2017-04-07T10:29:21.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1adbad10e5193b7533bccbae9bfa660f29162730fd4bd89c332bf8ae5b96ae78",
|
|
"pattern": "[file:hashes.SHA1 = '868a67c95a78cb80c86017ad313a7ae20b11cefa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a02-f5d0-45ae-8f56-4ff802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:22.000Z",
|
|
"modified": "2017-04-07T10:29:22.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1adbad10e5193b7533bccbae9bfa660f29162730fd4bd89c332bf8ae5b96ae78",
|
|
"pattern": "[file:hashes.MD5 = 'c4a2e6d6e7811352eb9102a0479a9265']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a03-7edc-4855-a29c-425702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:23.000Z",
|
|
"modified": "2017-04-07T10:29:23.000Z",
|
|
"first_observed": "2017-04-07T10:29:23Z",
|
|
"last_observed": "2017-04-07T10:29:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a03-7edc-4855-a29c-425702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a03-7edc-4855-a29c-425702de0b81",
|
|
"value": "https://www.virustotal.com/file/1adbad10e5193b7533bccbae9bfa660f29162730fd4bd89c332bf8ae5b96ae78/analysis/1491507331/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a04-c4c8-499c-be0d-4f5d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:24.000Z",
|
|
"modified": "2017-04-07T10:29:24.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e0b2671b1ba7ac123b6ec3e152711691e8690839b8e04fbb748d2fa8a4f5e982",
|
|
"pattern": "[file:hashes.SHA1 = 'ea857db45ba552ad3effc787cac07d1d13c06f3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a05-bb68-4f5c-8d4b-4d7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:25.000Z",
|
|
"modified": "2017-04-07T10:29:25.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e0b2671b1ba7ac123b6ec3e152711691e8690839b8e04fbb748d2fa8a4f5e982",
|
|
"pattern": "[file:hashes.MD5 = '4299fbfe74f671ee2c36d71bc808437c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a06-6d70-4843-aaad-461402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:26.000Z",
|
|
"modified": "2017-04-07T10:29:26.000Z",
|
|
"first_observed": "2017-04-07T10:29:26Z",
|
|
"last_observed": "2017-04-07T10:29:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a06-6d70-4843-aaad-461402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a06-6d70-4843-aaad-461402de0b81",
|
|
"value": "https://www.virustotal.com/file/e0b2671b1ba7ac123b6ec3e152711691e8690839b8e04fbb748d2fa8a4f5e982/analysis/1491514011/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a07-8208-4e1e-adb4-49fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:27.000Z",
|
|
"modified": "2017-04-07T10:29:27.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 54e5f4ecd18c6a18a6f25be6b7a392cbbd5bc107b868d8a078bf3e3fa701e453",
|
|
"pattern": "[file:hashes.SHA1 = 'a4cac28e41ad799abc1213689230985811cf0b76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a08-ef84-46d1-a7ef-4a4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:28.000Z",
|
|
"modified": "2017-04-07T10:29:28.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 54e5f4ecd18c6a18a6f25be6b7a392cbbd5bc107b868d8a078bf3e3fa701e453",
|
|
"pattern": "[file:hashes.MD5 = '5bbb5604bc0f656545dfcbb09820d61a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a09-5df8-4dde-9cca-40d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:29.000Z",
|
|
"modified": "2017-04-07T10:29:29.000Z",
|
|
"first_observed": "2017-04-07T10:29:29Z",
|
|
"last_observed": "2017-04-07T10:29:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a09-5df8-4dde-9cca-40d702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a09-5df8-4dde-9cca-40d702de0b81",
|
|
"value": "https://www.virustotal.com/file/54e5f4ecd18c6a18a6f25be6b7a392cbbd5bc107b868d8a078bf3e3fa701e453/analysis/1491514011/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a0a-09a8-418d-83ad-492702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:30.000Z",
|
|
"modified": "2017-04-07T10:29:30.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 559e6970861563f815e097a7a152970508323666c511afbc8165c4869256f692",
|
|
"pattern": "[file:hashes.SHA1 = '06d1239234cc1fd1aa757518d6c4059331eaf873']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a0b-e3a8-43bb-9637-44e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:31.000Z",
|
|
"modified": "2017-04-07T10:29:31.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 559e6970861563f815e097a7a152970508323666c511afbc8165c4869256f692",
|
|
"pattern": "[file:hashes.MD5 = 'cd38d10f4bc730b40be1f80b3034e31e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a0c-96b8-4919-bf73-426302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:32.000Z",
|
|
"modified": "2017-04-07T10:29:32.000Z",
|
|
"first_observed": "2017-04-07T10:29:32Z",
|
|
"last_observed": "2017-04-07T10:29:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a0c-96b8-4919-bf73-426302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a0c-96b8-4919-bf73-426302de0b81",
|
|
"value": "https://www.virustotal.com/file/559e6970861563f815e097a7a152970508323666c511afbc8165c4869256f692/analysis/1491514010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a0d-4e78-4218-b7ba-46b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:33.000Z",
|
|
"modified": "2017-04-07T10:29:33.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e05a329bbfe8cc0f7f3e2296fe0bdf86b6d4df70a8242409feb6c846db0b221c",
|
|
"pattern": "[file:hashes.SHA1 = 'e3da0d9a9437807d054170e115728e0ccec51465']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a0e-7720-4d1c-85a5-4e5e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:34.000Z",
|
|
"modified": "2017-04-07T10:29:34.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e05a329bbfe8cc0f7f3e2296fe0bdf86b6d4df70a8242409feb6c846db0b221c",
|
|
"pattern": "[file:hashes.MD5 = 'ec6c6334946cb48bb2fd646a1966edf9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a0e-a874-4953-8b5e-4b6002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:34.000Z",
|
|
"modified": "2017-04-07T10:29:34.000Z",
|
|
"first_observed": "2017-04-07T10:29:34Z",
|
|
"last_observed": "2017-04-07T10:29:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a0e-a874-4953-8b5e-4b6002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a0e-a874-4953-8b5e-4b6002de0b81",
|
|
"value": "https://www.virustotal.com/file/e05a329bbfe8cc0f7f3e2296fe0bdf86b6d4df70a8242409feb6c846db0b221c/analysis/1491514010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a0f-d1bc-4233-8092-406f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:35.000Z",
|
|
"modified": "2017-04-07T10:29:35.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6c21e4331ec2d02e427025efeb6fbaf8c779513027720d24365283d5166add77",
|
|
"pattern": "[file:hashes.SHA1 = '863636095f4779891f29595ed00e4d3e90a87257']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a10-2b4c-43af-87b9-431602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:36.000Z",
|
|
"modified": "2017-04-07T10:29:36.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6c21e4331ec2d02e427025efeb6fbaf8c779513027720d24365283d5166add77",
|
|
"pattern": "[file:hashes.MD5 = '882cab29144e1cb9e0512b8f1103b2da']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a11-3900-411b-9ad0-42f402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:37.000Z",
|
|
"modified": "2017-04-07T10:29:37.000Z",
|
|
"first_observed": "2017-04-07T10:29:37Z",
|
|
"last_observed": "2017-04-07T10:29:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a11-3900-411b-9ad0-42f402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a11-3900-411b-9ad0-42f402de0b81",
|
|
"value": "https://www.virustotal.com/file/6c21e4331ec2d02e427025efeb6fbaf8c779513027720d24365283d5166add77/analysis/1491514010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a12-865c-4e0a-8c9a-449e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:38.000Z",
|
|
"modified": "2017-04-07T10:29:38.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 3a4498a6e4213a680dd2e57516637f7480c0bd7a342ec24788fdb9694b0d1150",
|
|
"pattern": "[file:hashes.SHA1 = 'f2e5753529e0308fbf45b801d09b9aaec6f32f9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a13-a4cc-4375-bf12-440002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:39.000Z",
|
|
"modified": "2017-04-07T10:29:39.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 3a4498a6e4213a680dd2e57516637f7480c0bd7a342ec24788fdb9694b0d1150",
|
|
"pattern": "[file:hashes.MD5 = 'd0d9d6d74f9405cdc924760e3d460d84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a14-bedc-4c56-aaa8-421002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:40.000Z",
|
|
"modified": "2017-04-07T10:29:40.000Z",
|
|
"first_observed": "2017-04-07T10:29:40Z",
|
|
"last_observed": "2017-04-07T10:29:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a14-bedc-4c56-aaa8-421002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a14-bedc-4c56-aaa8-421002de0b81",
|
|
"value": "https://www.virustotal.com/file/3a4498a6e4213a680dd2e57516637f7480c0bd7a342ec24788fdb9694b0d1150/analysis/1491514010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a15-7794-48e7-9dbe-442802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:41.000Z",
|
|
"modified": "2017-04-07T10:29:41.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: def8065164959595de2ff6b35141985e7fd7a6c836db0b7a3f389b022c7f3650",
|
|
"pattern": "[file:hashes.SHA1 = '99038f83fbfc70fb90e8f352cd2eb8635bf5cbd8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a16-da9c-498e-80f1-430102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:42.000Z",
|
|
"modified": "2017-04-07T10:29:42.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: def8065164959595de2ff6b35141985e7fd7a6c836db0b7a3f389b022c7f3650",
|
|
"pattern": "[file:hashes.MD5 = '1c2ad73d6b74bcb24081ce56fb8c679f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a16-83b0-4b2b-93bf-454d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:42.000Z",
|
|
"modified": "2017-04-07T10:29:42.000Z",
|
|
"first_observed": "2017-04-07T10:29:42Z",
|
|
"last_observed": "2017-04-07T10:29:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a16-83b0-4b2b-93bf-454d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a16-83b0-4b2b-93bf-454d02de0b81",
|
|
"value": "https://www.virustotal.com/file/def8065164959595de2ff6b35141985e7fd7a6c836db0b7a3f389b022c7f3650/analysis/1491514010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a17-4468-46ce-88de-4e4602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:43.000Z",
|
|
"modified": "2017-04-07T10:29:43.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cf9287ded9b5a6543afc66ca60c4d20e6f7e4c318e8f303567d781eb98e4168c",
|
|
"pattern": "[file:hashes.SHA1 = '8209796053de9b998b330442a34d63b6f189828c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a18-5c28-49d0-97b0-481a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:44.000Z",
|
|
"modified": "2017-04-07T10:29:44.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cf9287ded9b5a6543afc66ca60c4d20e6f7e4c318e8f303567d781eb98e4168c",
|
|
"pattern": "[file:hashes.MD5 = '96d5c2a040fac48ce80d8a435c577d70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a19-9af0-401f-9c5e-416102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:45.000Z",
|
|
"modified": "2017-04-07T10:29:45.000Z",
|
|
"first_observed": "2017-04-07T10:29:45Z",
|
|
"last_observed": "2017-04-07T10:29:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a19-9af0-401f-9c5e-416102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a19-9af0-401f-9c5e-416102de0b81",
|
|
"value": "https://www.virustotal.com/file/cf9287ded9b5a6543afc66ca60c4d20e6f7e4c318e8f303567d781eb98e4168c/analysis/1491507261/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a1a-ec34-4399-acef-4af802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:46.000Z",
|
|
"modified": "2017-04-07T10:29:46.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b5846554ee1ef9de0a8d83527f609abf5b328d104056b7a763ed89e75152ddbf",
|
|
"pattern": "[file:hashes.SHA1 = '0678c4bedea0ee7cf60776af70c152b71972138b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a1b-b460-441c-8b3a-463e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:47.000Z",
|
|
"modified": "2017-04-07T10:29:47.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b5846554ee1ef9de0a8d83527f609abf5b328d104056b7a763ed89e75152ddbf",
|
|
"pattern": "[file:hashes.MD5 = '79902094e6d5b7fa06a31e99841d0a71']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a1c-5a84-424a-9de6-402a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:48.000Z",
|
|
"modified": "2017-04-07T10:29:48.000Z",
|
|
"first_observed": "2017-04-07T10:29:48Z",
|
|
"last_observed": "2017-04-07T10:29:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a1c-5a84-424a-9de6-402a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a1c-5a84-424a-9de6-402a02de0b81",
|
|
"value": "https://www.virustotal.com/file/b5846554ee1ef9de0a8d83527f609abf5b328d104056b7a763ed89e75152ddbf/analysis/1491514009/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a1d-3e70-431f-938f-46e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:49.000Z",
|
|
"modified": "2017-04-07T10:29:49.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a2cad08db8e151a90857df70d9e9c5e605aac6fa0e6e5d5ad150c96027743612",
|
|
"pattern": "[file:hashes.SHA1 = '564318a2ec6406d75087cc4eee90202c1ef812cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a1e-305c-40f1-a9a9-4c3c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:50.000Z",
|
|
"modified": "2017-04-07T10:29:50.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a2cad08db8e151a90857df70d9e9c5e605aac6fa0e6e5d5ad150c96027743612",
|
|
"pattern": "[file:hashes.MD5 = 'f9155cabbdccc70f5ac86e754986c0a7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a1f-5aa8-490f-8c32-470d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:51.000Z",
|
|
"modified": "2017-04-07T10:29:51.000Z",
|
|
"first_observed": "2017-04-07T10:29:51Z",
|
|
"last_observed": "2017-04-07T10:29:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a1f-5aa8-490f-8c32-470d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a1f-5aa8-490f-8c32-470d02de0b81",
|
|
"value": "https://www.virustotal.com/file/a2cad08db8e151a90857df70d9e9c5e605aac6fa0e6e5d5ad150c96027743612/analysis/1491514009/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a20-bcc0-4366-adf7-4dd202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:52.000Z",
|
|
"modified": "2017-04-07T10:29:52.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: fb64d608573ba1b1fd4254e7a1c7b3ffa1dfdc678300cc5d16eb4a88cf7592e3",
|
|
"pattern": "[file:hashes.SHA1 = 'dea199010489953ff76de41e2b4737bc64c446e3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a21-b7b0-48be-933c-442802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:53.000Z",
|
|
"modified": "2017-04-07T10:29:53.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: fb64d608573ba1b1fd4254e7a1c7b3ffa1dfdc678300cc5d16eb4a88cf7592e3",
|
|
"pattern": "[file:hashes.MD5 = 'f0d7aee24f3a5108bcc8860ffeb10496']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a22-43a0-42f0-bc6c-41e702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:54.000Z",
|
|
"modified": "2017-04-07T10:29:54.000Z",
|
|
"first_observed": "2017-04-07T10:29:54Z",
|
|
"last_observed": "2017-04-07T10:29:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a22-43a0-42f0-bc6c-41e702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a22-43a0-42f0-bc6c-41e702de0b81",
|
|
"value": "https://www.virustotal.com/file/fb64d608573ba1b1fd4254e7a1c7b3ffa1dfdc678300cc5d16eb4a88cf7592e3/analysis/1491514008/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a23-ddc0-4522-b0e5-458602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:55.000Z",
|
|
"modified": "2017-04-07T10:29:55.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 04f6422325cf3fbe35879cb6532745d3a3b555144ef7b4e88ed96bf3fe4e70ac",
|
|
"pattern": "[file:hashes.SHA1 = '3ce1e9d55f4ad4a8208231b900e943b94449abd5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a24-f38c-408b-b06a-4f1302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:56.000Z",
|
|
"modified": "2017-04-07T10:29:56.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 04f6422325cf3fbe35879cb6532745d3a3b555144ef7b4e88ed96bf3fe4e70ac",
|
|
"pattern": "[file:hashes.MD5 = 'd91e3a1beb5a523a7cbdcb46edfe6d76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a24-6b10-44da-822d-4cf402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:56.000Z",
|
|
"modified": "2017-04-07T10:29:56.000Z",
|
|
"first_observed": "2017-04-07T10:29:56Z",
|
|
"last_observed": "2017-04-07T10:29:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a24-6b10-44da-822d-4cf402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a24-6b10-44da-822d-4cf402de0b81",
|
|
"value": "https://www.virustotal.com/file/04f6422325cf3fbe35879cb6532745d3a3b555144ef7b4e88ed96bf3fe4e70ac/analysis/1491514008/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a25-f520-4b54-996e-4de602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:57.000Z",
|
|
"modified": "2017-04-07T10:29:57.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 75329e7b79284f63c1383244b20fb0d9c4bb1e9c4feba04307f1223db30c9203",
|
|
"pattern": "[file:hashes.SHA1 = '5e706e34634cfb1fcae11ddf1260b540810b1565']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a26-aa50-48ca-838b-4d4902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:58.000Z",
|
|
"modified": "2017-04-07T10:29:58.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 75329e7b79284f63c1383244b20fb0d9c4bb1e9c4feba04307f1223db30c9203",
|
|
"pattern": "[file:hashes.MD5 = '78771eafed8984e240a85e98e97c97e8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:29:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a27-bd74-4dd2-9095-437602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:29:59.000Z",
|
|
"modified": "2017-04-07T10:29:59.000Z",
|
|
"first_observed": "2017-04-07T10:29:59Z",
|
|
"last_observed": "2017-04-07T10:29:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a27-bd74-4dd2-9095-437602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a27-bd74-4dd2-9095-437602de0b81",
|
|
"value": "https://www.virustotal.com/file/75329e7b79284f63c1383244b20fb0d9c4bb1e9c4feba04307f1223db30c9203/analysis/1491514008/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a28-ea74-4f62-8a69-463b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:00.000Z",
|
|
"modified": "2017-04-07T10:30:00.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8f3e3b93eddb3f1fecc75d46e9ea5eb5d2ba3283c1e040ca12cb7530b7eb2455",
|
|
"pattern": "[file:hashes.SHA1 = 'fe08487ee86d27568b8f59f2048e9bd3bf2d723a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a29-8f5c-4aef-b253-4dd402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:01.000Z",
|
|
"modified": "2017-04-07T10:30:01.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8f3e3b93eddb3f1fecc75d46e9ea5eb5d2ba3283c1e040ca12cb7530b7eb2455",
|
|
"pattern": "[file:hashes.MD5 = 'abf252b04d689a2a5720530e6c0252b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a2a-d734-49ed-a4bf-425d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:02.000Z",
|
|
"modified": "2017-04-07T10:30:02.000Z",
|
|
"first_observed": "2017-04-07T10:30:02Z",
|
|
"last_observed": "2017-04-07T10:30:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a2a-d734-49ed-a4bf-425d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a2a-d734-49ed-a4bf-425d02de0b81",
|
|
"value": "https://www.virustotal.com/file/8f3e3b93eddb3f1fecc75d46e9ea5eb5d2ba3283c1e040ca12cb7530b7eb2455/analysis/1491509249/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a2b-95e8-4585-8a50-470c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:03.000Z",
|
|
"modified": "2017-04-07T10:30:03.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2e225c32dc320ab2441274fc7acf6fe52bd9621314c27e806fa8c4bec409b5e3",
|
|
"pattern": "[file:hashes.SHA1 = 'f1de2799fe73d22356d2a83f8406cf9adec9fd90']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a2c-47d4-43dc-b63e-4fdd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:04.000Z",
|
|
"modified": "2017-04-07T10:30:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2e225c32dc320ab2441274fc7acf6fe52bd9621314c27e806fa8c4bec409b5e3",
|
|
"pattern": "[file:hashes.MD5 = 'a3c4effb16ac5710d5099d260220b488']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a2d-56f0-4ba4-8cc7-486702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:05.000Z",
|
|
"modified": "2017-04-07T10:30:05.000Z",
|
|
"first_observed": "2017-04-07T10:30:05Z",
|
|
"last_observed": "2017-04-07T10:30:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a2d-56f0-4ba4-8cc7-486702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a2d-56f0-4ba4-8cc7-486702de0b81",
|
|
"value": "https://www.virustotal.com/file/2e225c32dc320ab2441274fc7acf6fe52bd9621314c27e806fa8c4bec409b5e3/analysis/1491514005/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a2e-d0f8-423c-b4b9-455c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:06.000Z",
|
|
"modified": "2017-04-07T10:30:06.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7efaff81e5be73608bccad93185f6b559597d2819bb33c95436d9246ef602f49",
|
|
"pattern": "[file:hashes.SHA1 = 'ed835800d6f03e84d1d88b86074050eafa30474c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a2f-c514-41bf-842b-4fdb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:07.000Z",
|
|
"modified": "2017-04-07T10:30:07.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7efaff81e5be73608bccad93185f6b559597d2819bb33c95436d9246ef602f49",
|
|
"pattern": "[file:hashes.MD5 = 'ca24f2ff1b3a93215f30f499f6dfcc9a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a30-0b00-4c1f-a7a6-491d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:08.000Z",
|
|
"modified": "2017-04-07T10:30:08.000Z",
|
|
"first_observed": "2017-04-07T10:30:08Z",
|
|
"last_observed": "2017-04-07T10:30:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a30-0b00-4c1f-a7a6-491d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a30-0b00-4c1f-a7a6-491d02de0b81",
|
|
"value": "https://www.virustotal.com/file/7efaff81e5be73608bccad93185f6b559597d2819bb33c95436d9246ef602f49/analysis/1491506454/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a31-c1c8-4735-98af-4e0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:09.000Z",
|
|
"modified": "2017-04-07T10:30:09.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 85d2d2293364c90d51fba7696a44908e0fae50dae1337e59441692e91c25c9d1",
|
|
"pattern": "[file:hashes.SHA1 = '00d669b248a92bf8988207eab398a004353dc2af']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a32-f634-48be-88d3-4c4302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:10.000Z",
|
|
"modified": "2017-04-07T10:30:10.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 85d2d2293364c90d51fba7696a44908e0fae50dae1337e59441692e91c25c9d1",
|
|
"pattern": "[file:hashes.MD5 = '2c8216106a32319ea6e3634583f317a7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a32-a9ec-4da1-a0e7-476802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:10.000Z",
|
|
"modified": "2017-04-07T10:30:10.000Z",
|
|
"first_observed": "2017-04-07T10:30:10Z",
|
|
"last_observed": "2017-04-07T10:30:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a32-a9ec-4da1-a0e7-476802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a32-a9ec-4da1-a0e7-476802de0b81",
|
|
"value": "https://www.virustotal.com/file/85d2d2293364c90d51fba7696a44908e0fae50dae1337e59441692e91c25c9d1/analysis/1491514006/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a33-ab24-42d1-9a71-406402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:11.000Z",
|
|
"modified": "2017-04-07T10:30:11.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 114ef36f968912ef885d06e3d092dad739f9b6afe2f246e52fb3ba5e6bf8ee00",
|
|
"pattern": "[file:hashes.SHA1 = 'bc76b8ec18749a99fb5de882216b081a20c3719d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a34-9540-4a74-9ce9-475802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:12.000Z",
|
|
"modified": "2017-04-07T10:30:12.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 114ef36f968912ef885d06e3d092dad739f9b6afe2f246e52fb3ba5e6bf8ee00",
|
|
"pattern": "[file:hashes.MD5 = 'ddc685e809af307eecd84454ff8c588d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a35-36b0-4de5-82a6-4dde02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:13.000Z",
|
|
"modified": "2017-04-07T10:30:13.000Z",
|
|
"first_observed": "2017-04-07T10:30:13Z",
|
|
"last_observed": "2017-04-07T10:30:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a35-36b0-4de5-82a6-4dde02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a35-36b0-4de5-82a6-4dde02de0b81",
|
|
"value": "https://www.virustotal.com/file/114ef36f968912ef885d06e3d092dad739f9b6afe2f246e52fb3ba5e6bf8ee00/analysis/1491514005/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a36-18ac-48dc-a789-4f1402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:14.000Z",
|
|
"modified": "2017-04-07T10:30:14.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e477b5e00699a9ccb3868de543c29087042fd44c631f8fcda5faaf7922382146",
|
|
"pattern": "[file:hashes.SHA1 = '0c4d554cd0437151911ecdec6ee572ecb35dfbe9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a37-a2a0-44e9-8bc0-4efc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:15.000Z",
|
|
"modified": "2017-04-07T10:30:15.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e477b5e00699a9ccb3868de543c29087042fd44c631f8fcda5faaf7922382146",
|
|
"pattern": "[file:hashes.MD5 = '401f2ad5d53e8b387e43801a0353508a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a38-6048-4748-907e-481b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:16.000Z",
|
|
"modified": "2017-04-07T10:30:16.000Z",
|
|
"first_observed": "2017-04-07T10:30:16Z",
|
|
"last_observed": "2017-04-07T10:30:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a38-6048-4748-907e-481b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a38-6048-4748-907e-481b02de0b81",
|
|
"value": "https://www.virustotal.com/file/e477b5e00699a9ccb3868de543c29087042fd44c631f8fcda5faaf7922382146/analysis/1491506414/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a39-7e94-4889-8e59-44e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:17.000Z",
|
|
"modified": "2017-04-07T10:30:17.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a9ad6b278cabc7c9ac063c37b0656cd924639a227977ff250339479d5aa0863a",
|
|
"pattern": "[file:hashes.SHA1 = '67bfecd658cc2b710312fb0082a5b56c06d1809e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a3a-b148-4576-9885-434802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:18.000Z",
|
|
"modified": "2017-04-07T10:30:18.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a9ad6b278cabc7c9ac063c37b0656cd924639a227977ff250339479d5aa0863a",
|
|
"pattern": "[file:hashes.MD5 = '205dcaeb61b90c89a2f27de2b9c8b531']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a3b-8ec0-4cdd-a96f-4ef702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:19.000Z",
|
|
"modified": "2017-04-07T10:30:19.000Z",
|
|
"first_observed": "2017-04-07T10:30:19Z",
|
|
"last_observed": "2017-04-07T10:30:19Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a3b-8ec0-4cdd-a96f-4ef702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a3b-8ec0-4cdd-a96f-4ef702de0b81",
|
|
"value": "https://www.virustotal.com/file/a9ad6b278cabc7c9ac063c37b0656cd924639a227977ff250339479d5aa0863a/analysis/1491506269/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a3c-3480-4974-b649-4c7202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:20.000Z",
|
|
"modified": "2017-04-07T10:30:20.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0edc4424c8eeb9708b6b8bc74806b6c17c9cfbb49e2688f711092381823fc733",
|
|
"pattern": "[file:hashes.SHA1 = '2b715aead0add91f767a97e0af17dfb6caa96e6c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a3c-7a84-488e-8e4c-493502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:20.000Z",
|
|
"modified": "2017-04-07T10:30:20.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 0edc4424c8eeb9708b6b8bc74806b6c17c9cfbb49e2688f711092381823fc733",
|
|
"pattern": "[file:hashes.MD5 = '4fd4aca3f00507c7dd778efceb4b2f85']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a3d-3780-4f67-b869-4d4d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:21.000Z",
|
|
"modified": "2017-04-07T10:30:21.000Z",
|
|
"first_observed": "2017-04-07T10:30:21Z",
|
|
"last_observed": "2017-04-07T10:30:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a3d-3780-4f67-b869-4d4d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a3d-3780-4f67-b869-4d4d02de0b81",
|
|
"value": "https://www.virustotal.com/file/0edc4424c8eeb9708b6b8bc74806b6c17c9cfbb49e2688f711092381823fc733/analysis/1491514004/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a3e-4884-4434-b1f6-4ee802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:22.000Z",
|
|
"modified": "2017-04-07T10:30:22.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 499569d014d6b05e2187b8aa5966e4b56133cd67ff7a110c259cda5299cdd4b9",
|
|
"pattern": "[file:hashes.SHA1 = '44c3fc97f4101ee383d9c8b4f15f29f8dd23f0ea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a3f-9098-4aec-8f41-433502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:23.000Z",
|
|
"modified": "2017-04-07T10:30:23.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 499569d014d6b05e2187b8aa5966e4b56133cd67ff7a110c259cda5299cdd4b9",
|
|
"pattern": "[file:hashes.MD5 = 'bf376ffc368ddc88d62f47bda82ecf0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a40-a2b0-4298-9ac2-4c7602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:24.000Z",
|
|
"modified": "2017-04-07T10:30:24.000Z",
|
|
"first_observed": "2017-04-07T10:30:24Z",
|
|
"last_observed": "2017-04-07T10:30:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a40-a2b0-4298-9ac2-4c7602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a40-a2b0-4298-9ac2-4c7602de0b81",
|
|
"value": "https://www.virustotal.com/file/499569d014d6b05e2187b8aa5966e4b56133cd67ff7a110c259cda5299cdd4b9/analysis/1491514004/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a41-dac0-454a-8555-40d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:25.000Z",
|
|
"modified": "2017-04-07T10:30:25.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2b644917074452c385e4a960d9ef504ce22733047dc282ef31ba7c012041e58c",
|
|
"pattern": "[file:hashes.SHA1 = 'c2670fa9ff152d67d07c45e710663fafe770d7d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a42-0c80-4351-80f4-496002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:26.000Z",
|
|
"modified": "2017-04-07T10:30:26.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2b644917074452c385e4a960d9ef504ce22733047dc282ef31ba7c012041e58c",
|
|
"pattern": "[file:hashes.MD5 = '84e2d5d5ebcddeec32c6538b121d8301']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a43-2908-4093-8859-459d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:27.000Z",
|
|
"modified": "2017-04-07T10:30:27.000Z",
|
|
"first_observed": "2017-04-07T10:30:27Z",
|
|
"last_observed": "2017-04-07T10:30:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a43-2908-4093-8859-459d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a43-2908-4093-8859-459d02de0b81",
|
|
"value": "https://www.virustotal.com/file/2b644917074452c385e4a960d9ef504ce22733047dc282ef31ba7c012041e58c/analysis/1491514004/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a44-95bc-43f5-9fd6-4e5502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:28.000Z",
|
|
"modified": "2017-04-07T10:30:28.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6eea4d800b3af9363abcea6f5051039c2fe7bec3e690500077f022204588db6f",
|
|
"pattern": "[file:hashes.SHA1 = '0cd7efd8cf6f06e1eb50aebcf8f243b58908fe87']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a45-5a30-4391-a37a-46da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:29.000Z",
|
|
"modified": "2017-04-07T10:30:29.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6eea4d800b3af9363abcea6f5051039c2fe7bec3e690500077f022204588db6f",
|
|
"pattern": "[file:hashes.MD5 = '83a1ebc2cb4c2923003470b1662785c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a46-ad8c-4eb6-aaf8-48c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:30.000Z",
|
|
"modified": "2017-04-07T10:30:30.000Z",
|
|
"first_observed": "2017-04-07T10:30:30Z",
|
|
"last_observed": "2017-04-07T10:30:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a46-ad8c-4eb6-aaf8-48c402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a46-ad8c-4eb6-aaf8-48c402de0b81",
|
|
"value": "https://www.virustotal.com/file/6eea4d800b3af9363abcea6f5051039c2fe7bec3e690500077f022204588db6f/analysis/1491514003/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a47-332c-4b05-a157-462102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:31.000Z",
|
|
"modified": "2017-04-07T10:30:31.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d8d87ac1e004de113a5a394b757f612bcde22eaaab574e53d4b1909193b77b7f",
|
|
"pattern": "[file:hashes.SHA1 = 'b0e55369447b08e1d127d3edd1de2249e688a95e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a47-0bcc-4a86-ac2d-456002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:31.000Z",
|
|
"modified": "2017-04-07T10:30:31.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: d8d87ac1e004de113a5a394b757f612bcde22eaaab574e53d4b1909193b77b7f",
|
|
"pattern": "[file:hashes.MD5 = '927d544fe71cdd65acf3148acebc30c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a48-1810-4726-9136-4ca702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:32.000Z",
|
|
"modified": "2017-04-07T10:30:32.000Z",
|
|
"first_observed": "2017-04-07T10:30:32Z",
|
|
"last_observed": "2017-04-07T10:30:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a48-1810-4726-9136-4ca702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a48-1810-4726-9136-4ca702de0b81",
|
|
"value": "https://www.virustotal.com/file/d8d87ac1e004de113a5a394b757f612bcde22eaaab574e53d4b1909193b77b7f/analysis/1491514002/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a49-6fa8-4548-858e-40dc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:33.000Z",
|
|
"modified": "2017-04-07T10:30:33.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cfbe077d7a4807203c889292668695e114ed9524a11a00b0d670a2f4da74a27c",
|
|
"pattern": "[file:hashes.SHA1 = 'c1daa896f02671ef8ea6c6a3e34007c171a13fd6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a4a-93ac-4373-8db6-440002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:34.000Z",
|
|
"modified": "2017-04-07T10:30:34.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cfbe077d7a4807203c889292668695e114ed9524a11a00b0d670a2f4da74a27c",
|
|
"pattern": "[file:hashes.MD5 = '8c9053a747cd508d499f5277ae7f33f9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a4b-cf98-478f-830f-4b7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:35.000Z",
|
|
"modified": "2017-04-07T10:30:35.000Z",
|
|
"first_observed": "2017-04-07T10:30:35Z",
|
|
"last_observed": "2017-04-07T10:30:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a4b-cf98-478f-830f-4b7502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a4b-cf98-478f-830f-4b7502de0b81",
|
|
"value": "https://www.virustotal.com/file/cfbe077d7a4807203c889292668695e114ed9524a11a00b0d670a2f4da74a27c/analysis/1491506198/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a4c-fc7c-4f2c-b0de-424102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:36.000Z",
|
|
"modified": "2017-04-07T10:30:36.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b6f8b5ba026af863e878eded79f40e5efa1dd7ce725cd0479e5f062dbf4fdd4f",
|
|
"pattern": "[file:hashes.SHA1 = '46f0259d06724511188123f1baeeadcbaa78f9fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a4d-bbbc-42ed-9381-4e7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:37.000Z",
|
|
"modified": "2017-04-07T10:30:37.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b6f8b5ba026af863e878eded79f40e5efa1dd7ce725cd0479e5f062dbf4fdd4f",
|
|
"pattern": "[file:hashes.MD5 = 'f030defa9578b8994f9802ac2c062cd7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a4e-39f4-4f61-a3b2-467802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:38.000Z",
|
|
"modified": "2017-04-07T10:30:38.000Z",
|
|
"first_observed": "2017-04-07T10:30:38Z",
|
|
"last_observed": "2017-04-07T10:30:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a4e-39f4-4f61-a3b2-467802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a4e-39f4-4f61-a3b2-467802de0b81",
|
|
"value": "https://www.virustotal.com/file/b6f8b5ba026af863e878eded79f40e5efa1dd7ce725cd0479e5f062dbf4fdd4f/analysis/1491504062/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a4f-c950-4741-88a3-4f7f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:39.000Z",
|
|
"modified": "2017-04-07T10:30:39.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2cbafd6a0461e7ae1929897a8039ce5f198b76281465c49b4547abf9a139dd89",
|
|
"pattern": "[file:hashes.SHA1 = 'f7596cdecf67c3def0c71ca71374bff30f83751c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a50-722c-4a05-9d59-480c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:40.000Z",
|
|
"modified": "2017-04-07T10:30:40.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2cbafd6a0461e7ae1929897a8039ce5f198b76281465c49b4547abf9a139dd89",
|
|
"pattern": "[file:hashes.MD5 = 'd7825036eb4802fe9a690c852a65eef5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a51-5888-43e4-80c6-4d1f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:41.000Z",
|
|
"modified": "2017-04-07T10:30:41.000Z",
|
|
"first_observed": "2017-04-07T10:30:41Z",
|
|
"last_observed": "2017-04-07T10:30:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a51-5888-43e4-80c6-4d1f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a51-5888-43e4-80c6-4d1f02de0b81",
|
|
"value": "https://www.virustotal.com/file/2cbafd6a0461e7ae1929897a8039ce5f198b76281465c49b4547abf9a139dd89/analysis/1491514001/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a52-3ae0-49e1-aa3b-40f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:42.000Z",
|
|
"modified": "2017-04-07T10:30:42.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: dd185667015d23438a994adc9e9b30572a1e7479c05f563e0b6c71b8c6023685",
|
|
"pattern": "[file:hashes.SHA1 = '64e870f2b05ab6e723e146a8ca1a3e98e80ebb3a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a52-62b0-4e3e-8011-459802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:42.000Z",
|
|
"modified": "2017-04-07T10:30:42.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: dd185667015d23438a994adc9e9b30572a1e7479c05f563e0b6c71b8c6023685",
|
|
"pattern": "[file:hashes.MD5 = '86366fc738db6033ae8d56570be9b7b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a53-902c-41bc-9223-4a4d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:43.000Z",
|
|
"modified": "2017-04-07T10:30:43.000Z",
|
|
"first_observed": "2017-04-07T10:30:43Z",
|
|
"last_observed": "2017-04-07T10:30:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a53-902c-41bc-9223-4a4d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a53-902c-41bc-9223-4a4d02de0b81",
|
|
"value": "https://www.virustotal.com/file/dd185667015d23438a994adc9e9b30572a1e7479c05f563e0b6c71b8c6023685/analysis/1491503988/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a54-6c90-494e-9334-428802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:44.000Z",
|
|
"modified": "2017-04-07T10:30:44.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: fb95a719c4b26bb577cea5837cac6ba9fdfcfd240bc2fc7b1d0759bf392d5191",
|
|
"pattern": "[file:hashes.SHA1 = 'cee3b06fe5cfeaa1927f87df1e11fdff16689261']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a55-0b6c-4e77-a096-456f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:45.000Z",
|
|
"modified": "2017-04-07T10:30:45.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: fb95a719c4b26bb577cea5837cac6ba9fdfcfd240bc2fc7b1d0759bf392d5191",
|
|
"pattern": "[file:hashes.MD5 = '3ef88081662712f123d438b44e399c12']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a56-bf4c-4626-908e-472b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:46.000Z",
|
|
"modified": "2017-04-07T10:30:46.000Z",
|
|
"first_observed": "2017-04-07T10:30:46Z",
|
|
"last_observed": "2017-04-07T10:30:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a56-bf4c-4626-908e-472b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a56-bf4c-4626-908e-472b02de0b81",
|
|
"value": "https://www.virustotal.com/file/fb95a719c4b26bb577cea5837cac6ba9fdfcfd240bc2fc7b1d0759bf392d5191/analysis/1491503875/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a57-6c84-40c4-9751-40c702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:47.000Z",
|
|
"modified": "2017-04-07T10:30:47.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6aeebb3cdb2ca9b325e042e76d195a5ac958b119baa559532c22d344f1491a30",
|
|
"pattern": "[file:hashes.SHA1 = '9c74f0525942b338d213e60306f4655e0ad4df95']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a58-e09c-49d0-8fa9-4eff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:48.000Z",
|
|
"modified": "2017-04-07T10:30:48.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6aeebb3cdb2ca9b325e042e76d195a5ac958b119baa559532c22d344f1491a30",
|
|
"pattern": "[file:hashes.MD5 = 'ac9131660f6a614162a01e8cc8948d52']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a59-37b0-426a-a8c9-437802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:49.000Z",
|
|
"modified": "2017-04-07T10:30:49.000Z",
|
|
"first_observed": "2017-04-07T10:30:49Z",
|
|
"last_observed": "2017-04-07T10:30:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a59-37b0-426a-a8c9-437802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a59-37b0-426a-a8c9-437802de0b81",
|
|
"value": "https://www.virustotal.com/file/6aeebb3cdb2ca9b325e042e76d195a5ac958b119baa559532c22d344f1491a30/analysis/1491500035/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a5a-1304-491f-bc44-468c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:50.000Z",
|
|
"modified": "2017-04-07T10:30:50.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 39e4e3637e651d2d8251c0f891dc4b0f0494c9bada2da930761d3fe6cc6ebaae",
|
|
"pattern": "[file:hashes.SHA1 = '4b93a6ac506918e08cf048670441c9cafd028cec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a5b-dc80-4789-9597-455702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:51.000Z",
|
|
"modified": "2017-04-07T10:30:51.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 39e4e3637e651d2d8251c0f891dc4b0f0494c9bada2da930761d3fe6cc6ebaae",
|
|
"pattern": "[file:hashes.MD5 = '0d40eb7d51a4a5ae61bedad3ffee3d56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a5c-927c-4a0a-97e3-4bfb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:52.000Z",
|
|
"modified": "2017-04-07T10:30:52.000Z",
|
|
"first_observed": "2017-04-07T10:30:52Z",
|
|
"last_observed": "2017-04-07T10:30:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a5c-927c-4a0a-97e3-4bfb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a5c-927c-4a0a-97e3-4bfb02de0b81",
|
|
"value": "https://www.virustotal.com/file/39e4e3637e651d2d8251c0f891dc4b0f0494c9bada2da930761d3fe6cc6ebaae/analysis/1491514001/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a5d-2248-4432-8d44-4a8202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:53.000Z",
|
|
"modified": "2017-04-07T10:30:53.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: adbb67b004131990598009162a195b04107231a79de25945de94d2978f96dcd5",
|
|
"pattern": "[file:hashes.SHA1 = 'dcbe8b2e6c4e59c219cfdf2322004941a8abefad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a5e-f670-43de-b790-4df602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:54.000Z",
|
|
"modified": "2017-04-07T10:30:54.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: adbb67b004131990598009162a195b04107231a79de25945de94d2978f96dcd5",
|
|
"pattern": "[file:hashes.MD5 = '2fd81bb4b270791fad5936b4efd3e0df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a5e-2220-45ea-a97c-44da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:54.000Z",
|
|
"modified": "2017-04-07T10:30:54.000Z",
|
|
"first_observed": "2017-04-07T10:30:54Z",
|
|
"last_observed": "2017-04-07T10:30:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a5e-2220-45ea-a97c-44da02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a5e-2220-45ea-a97c-44da02de0b81",
|
|
"value": "https://www.virustotal.com/file/adbb67b004131990598009162a195b04107231a79de25945de94d2978f96dcd5/analysis/1491499969/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a5f-cad0-4a6b-88c3-4a1402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:55.000Z",
|
|
"modified": "2017-04-07T10:30:55.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 63d9a5ef92a18dc7238bcc59330b41149cec4ef7602b18c0b99abdae83c0114c",
|
|
"pattern": "[file:hashes.SHA1 = '792e0b2787994c6237aeb962d5ed6978d225f5a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a60-32dc-47c4-a235-414502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:56.000Z",
|
|
"modified": "2017-04-07T10:30:56.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 63d9a5ef92a18dc7238bcc59330b41149cec4ef7602b18c0b99abdae83c0114c",
|
|
"pattern": "[file:hashes.MD5 = 'a111af210dc777621f79edffb6bed6f3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a61-f768-4c20-95b9-419902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:57.000Z",
|
|
"modified": "2017-04-07T10:30:57.000Z",
|
|
"first_observed": "2017-04-07T10:30:57Z",
|
|
"last_observed": "2017-04-07T10:30:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a61-f768-4c20-95b9-419902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a61-f768-4c20-95b9-419902de0b81",
|
|
"value": "https://www.virustotal.com/file/63d9a5ef92a18dc7238bcc59330b41149cec4ef7602b18c0b99abdae83c0114c/analysis/1491514001/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a62-0c48-4f52-9e5c-4b1c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:58.000Z",
|
|
"modified": "2017-04-07T10:30:58.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 023cee622d8ddd7afd7603c1ba13447931508140cfe0dfd85bf4adc5b0d2cf8e",
|
|
"pattern": "[file:hashes.SHA1 = '0c91b4a692dbf3a81f4d779c4cfad10f0d9327e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a63-21ac-49ce-827b-4fbc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:30:59.000Z",
|
|
"modified": "2017-04-07T10:30:59.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 023cee622d8ddd7afd7603c1ba13447931508140cfe0dfd85bf4adc5b0d2cf8e",
|
|
"pattern": "[file:hashes.MD5 = '662ae23476cc0ef97deaaf97c1ee64b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:30:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a64-0dc4-4f73-9093-46bd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:00.000Z",
|
|
"modified": "2017-04-07T10:31:00.000Z",
|
|
"first_observed": "2017-04-07T10:31:00Z",
|
|
"last_observed": "2017-04-07T10:31:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a64-0dc4-4f73-9093-46bd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a64-0dc4-4f73-9093-46bd02de0b81",
|
|
"value": "https://www.virustotal.com/file/023cee622d8ddd7afd7603c1ba13447931508140cfe0dfd85bf4adc5b0d2cf8e/analysis/1491499784/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a65-1314-4c72-b3a1-48fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:01.000Z",
|
|
"modified": "2017-04-07T10:31:01.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7dd7cc9e90b074ecc3d8f5540864e105fc0cc034a18a0681bd0ab14252bd0387",
|
|
"pattern": "[file:hashes.SHA1 = 'a63af1adaa462d7f9fc5032c39dfa8d96f2af1a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a66-2340-41da-92a5-4d8702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:02.000Z",
|
|
"modified": "2017-04-07T10:31:02.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 7dd7cc9e90b074ecc3d8f5540864e105fc0cc034a18a0681bd0ab14252bd0387",
|
|
"pattern": "[file:hashes.MD5 = '51e5fb808aef2a65eab53b2ccea57dd3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a67-cf74-476f-a34e-44ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:03.000Z",
|
|
"modified": "2017-04-07T10:31:03.000Z",
|
|
"first_observed": "2017-04-07T10:31:03Z",
|
|
"last_observed": "2017-04-07T10:31:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a67-cf74-476f-a34e-44ad02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a67-cf74-476f-a34e-44ad02de0b81",
|
|
"value": "https://www.virustotal.com/file/7dd7cc9e90b074ecc3d8f5540864e105fc0cc034a18a0681bd0ab14252bd0387/analysis/1491514000/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a67-88a4-4577-9dba-4bdb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:03.000Z",
|
|
"modified": "2017-04-07T10:31:03.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6e461a8430f251db38e8911dbacd1e72bce47a89c28956115b702d13ae2b8e3b",
|
|
"pattern": "[file:hashes.SHA1 = '0757d573de3f69c5f4d5aca0dfa2915b8a126df6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a68-f644-41c6-b3f9-46aa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:04.000Z",
|
|
"modified": "2017-04-07T10:31:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6e461a8430f251db38e8911dbacd1e72bce47a89c28956115b702d13ae2b8e3b",
|
|
"pattern": "[file:hashes.MD5 = '2bb84cfe548fec7fb123d7e46cf67ff4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a69-a2f0-4b00-85d5-467602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:05.000Z",
|
|
"modified": "2017-04-07T10:31:05.000Z",
|
|
"first_observed": "2017-04-07T10:31:05Z",
|
|
"last_observed": "2017-04-07T10:31:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a69-a2f0-4b00-85d5-467602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a69-a2f0-4b00-85d5-467602de0b81",
|
|
"value": "https://www.virustotal.com/file/6e461a8430f251db38e8911dbacd1e72bce47a89c28956115b702d13ae2b8e3b/analysis/1491513999/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a6a-2984-4c86-a48f-493302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:06.000Z",
|
|
"modified": "2017-04-07T10:31:06.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 4f1be1f1c28dfc337a37cf22611aa288565c294910083524be4a317306b5490c",
|
|
"pattern": "[file:hashes.SHA1 = '7500207239288b45c217d17ab6196c95f8e922cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a6b-81b4-4ba5-9dcc-434102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:07.000Z",
|
|
"modified": "2017-04-07T10:31:07.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 4f1be1f1c28dfc337a37cf22611aa288565c294910083524be4a317306b5490c",
|
|
"pattern": "[file:hashes.MD5 = '01da432c8aaa7c9fb811e573fe626ecc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a6c-84a4-426b-a659-49b302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:08.000Z",
|
|
"modified": "2017-04-07T10:31:08.000Z",
|
|
"first_observed": "2017-04-07T10:31:08Z",
|
|
"last_observed": "2017-04-07T10:31:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a6c-84a4-426b-a659-49b302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a6c-84a4-426b-a659-49b302de0b81",
|
|
"value": "https://www.virustotal.com/file/4f1be1f1c28dfc337a37cf22611aa288565c294910083524be4a317306b5490c/analysis/1491513999/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a6d-3f14-4599-bedb-404402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:09.000Z",
|
|
"modified": "2017-04-07T10:31:09.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: accf87a349b0cfe6403e827089d7a97a8a9bf94dc4535d9ce2e54ecf9bc699fa",
|
|
"pattern": "[file:hashes.SHA1 = '154ea5cf1cdbcd9808849c9047ce22b8636c7f3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a6e-4558-451e-ac9b-4ab502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:10.000Z",
|
|
"modified": "2017-04-07T10:31:10.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: accf87a349b0cfe6403e827089d7a97a8a9bf94dc4535d9ce2e54ecf9bc699fa",
|
|
"pattern": "[file:hashes.MD5 = '5b2dc3b75f1944b73c2101ff1077f690']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a6e-c314-401e-b556-4e8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:10.000Z",
|
|
"modified": "2017-04-07T10:31:10.000Z",
|
|
"first_observed": "2017-04-07T10:31:10Z",
|
|
"last_observed": "2017-04-07T10:31:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a6e-c314-401e-b556-4e8302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a6e-c314-401e-b556-4e8302de0b81",
|
|
"value": "https://www.virustotal.com/file/accf87a349b0cfe6403e827089d7a97a8a9bf94dc4535d9ce2e54ecf9bc699fa/analysis/1491513998/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a6f-6de0-4f8a-bcc5-49fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:11.000Z",
|
|
"modified": "2017-04-07T10:31:11.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 5bab8a360d1d08e37e4e6c052f7fce13a291ad9b99f950770a647222bfc4d6b4",
|
|
"pattern": "[file:hashes.SHA1 = '08baad39f2d4b072bf02e1a5a7a527de56eb2093']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a70-1da0-4431-9406-476902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:12.000Z",
|
|
"modified": "2017-04-07T10:31:12.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 5bab8a360d1d08e37e4e6c052f7fce13a291ad9b99f950770a647222bfc4d6b4",
|
|
"pattern": "[file:hashes.MD5 = '56ab37da8336a4a9a80ec9bda2659930']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a71-459c-49d1-abf8-4b8002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:13.000Z",
|
|
"modified": "2017-04-07T10:31:13.000Z",
|
|
"first_observed": "2017-04-07T10:31:13Z",
|
|
"last_observed": "2017-04-07T10:31:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a71-459c-49d1-abf8-4b8002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a71-459c-49d1-abf8-4b8002de0b81",
|
|
"value": "https://www.virustotal.com/file/5bab8a360d1d08e37e4e6c052f7fce13a291ad9b99f950770a647222bfc4d6b4/analysis/1491513999/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a72-1588-496b-be88-42c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:14.000Z",
|
|
"modified": "2017-04-07T10:31:14.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: c4e79e151986dc5e16ce763321de90d8c214909df7210ec05e590c4375423a76",
|
|
"pattern": "[file:hashes.SHA1 = '90f93de55145b6577525421354ff05842cbe6271']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a73-7654-4089-976d-44b702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:15.000Z",
|
|
"modified": "2017-04-07T10:31:15.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: c4e79e151986dc5e16ce763321de90d8c214909df7210ec05e590c4375423a76",
|
|
"pattern": "[file:hashes.MD5 = '090edcc95e38d27e686b6329c3bee8fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a74-28d0-49b0-8a11-453d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:16.000Z",
|
|
"modified": "2017-04-07T10:31:16.000Z",
|
|
"first_observed": "2017-04-07T10:31:16Z",
|
|
"last_observed": "2017-04-07T10:31:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a74-28d0-49b0-8a11-453d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a74-28d0-49b0-8a11-453d02de0b81",
|
|
"value": "https://www.virustotal.com/file/c4e79e151986dc5e16ce763321de90d8c214909df7210ec05e590c4375423a76/analysis/1491513999/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a75-0040-4f4c-8da5-49ab02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:17.000Z",
|
|
"modified": "2017-04-07T10:31:17.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6c3bcef39b3892b5c3ed5602624ca5ee244cca7bf86aebe293bbd11eaf57834f",
|
|
"pattern": "[file:hashes.SHA1 = '5022bc5baabe668ccaba60946e32dfc647ee60b8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a75-f248-433e-9e97-44ce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:17.000Z",
|
|
"modified": "2017-04-07T10:31:17.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 6c3bcef39b3892b5c3ed5602624ca5ee244cca7bf86aebe293bbd11eaf57834f",
|
|
"pattern": "[file:hashes.MD5 = 'b525e5ceb7c06e2e94c1604224d2c4dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a76-75d8-4bbb-b365-4d1902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:18.000Z",
|
|
"modified": "2017-04-07T10:31:18.000Z",
|
|
"first_observed": "2017-04-07T10:31:18Z",
|
|
"last_observed": "2017-04-07T10:31:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a76-75d8-4bbb-b365-4d1902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a76-75d8-4bbb-b365-4d1902de0b81",
|
|
"value": "https://www.virustotal.com/file/6c3bcef39b3892b5c3ed5602624ca5ee244cca7bf86aebe293bbd11eaf57834f/analysis/1491513998/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a77-aeb4-4858-8279-40f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:19.000Z",
|
|
"modified": "2017-04-07T10:31:19.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 39aa9cc3747a7fc9c80a04ef47107950c1946386525d79fe97b0bfb593e4bdc2",
|
|
"pattern": "[file:hashes.SHA1 = '26ecc0d26fdbca2e3404c091037236fca21781d1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a78-1c20-4612-a7f1-4be202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:20.000Z",
|
|
"modified": "2017-04-07T10:31:20.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 39aa9cc3747a7fc9c80a04ef47107950c1946386525d79fe97b0bfb593e4bdc2",
|
|
"pattern": "[file:hashes.MD5 = '356c76586babdde4717098675e762900']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a79-fee4-49f2-8ef9-4c2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:21.000Z",
|
|
"modified": "2017-04-07T10:31:21.000Z",
|
|
"first_observed": "2017-04-07T10:31:21Z",
|
|
"last_observed": "2017-04-07T10:31:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a79-fee4-49f2-8ef9-4c2602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a79-fee4-49f2-8ef9-4c2602de0b81",
|
|
"value": "https://www.virustotal.com/file/39aa9cc3747a7fc9c80a04ef47107950c1946386525d79fe97b0bfb593e4bdc2/analysis/1491513998/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a7a-7d84-4f84-8701-486802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:22.000Z",
|
|
"modified": "2017-04-07T10:31:22.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 74a94b549fd52e8c23c1fca23a80262a50ae8e08ae56adf9e94c54acf2b313bf",
|
|
"pattern": "[file:hashes.SHA1 = 'f1bc70030eff3f4b9844dab0e210c5b3b4103b6f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a7b-b448-4f49-8166-4f0c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:23.000Z",
|
|
"modified": "2017-04-07T10:31:23.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 74a94b549fd52e8c23c1fca23a80262a50ae8e08ae56adf9e94c54acf2b313bf",
|
|
"pattern": "[file:hashes.MD5 = 'a9b9af173ba34fed95e89482e2f6863c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a7c-613c-41f6-9dea-4b8402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:24.000Z",
|
|
"modified": "2017-04-07T10:31:24.000Z",
|
|
"first_observed": "2017-04-07T10:31:24Z",
|
|
"last_observed": "2017-04-07T10:31:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a7c-613c-41f6-9dea-4b8402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a7c-613c-41f6-9dea-4b8402de0b81",
|
|
"value": "https://www.virustotal.com/file/74a94b549fd52e8c23c1fca23a80262a50ae8e08ae56adf9e94c54acf2b313bf/analysis/1491513997/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a7c-1894-4af5-b3dc-4a1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:24.000Z",
|
|
"modified": "2017-04-07T10:31:24.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b284c718d5b6c30eea2a0df34d9d75d3a22baa776b8d6f75b579da5549529f43",
|
|
"pattern": "[file:hashes.SHA1 = '8d692bad1dfbca1cbba99fab99d3db090400b546']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a7d-4e64-4701-95d4-4a4402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:25.000Z",
|
|
"modified": "2017-04-07T10:31:25.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b284c718d5b6c30eea2a0df34d9d75d3a22baa776b8d6f75b579da5549529f43",
|
|
"pattern": "[file:hashes.MD5 = 'e73821e1767efde88b1aef203fe65136']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a7e-8ad0-4fb1-8683-49d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:26.000Z",
|
|
"modified": "2017-04-07T10:31:26.000Z",
|
|
"first_observed": "2017-04-07T10:31:26Z",
|
|
"last_observed": "2017-04-07T10:31:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a7e-8ad0-4fb1-8683-49d302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a7e-8ad0-4fb1-8683-49d302de0b81",
|
|
"value": "https://www.virustotal.com/file/b284c718d5b6c30eea2a0df34d9d75d3a22baa776b8d6f75b579da5549529f43/analysis/1491513998/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a7f-b200-43a4-bfea-475702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:27.000Z",
|
|
"modified": "2017-04-07T10:31:27.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 41b3e90442c97e40abdf29d8b7ecedea1026a1fb4dbd6d6cc410d3f3463cb205",
|
|
"pattern": "[file:hashes.SHA1 = 'f59f68133a761e78f805f2e3bc310da811a60b0b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a80-3490-484e-b4c1-4ee802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:28.000Z",
|
|
"modified": "2017-04-07T10:31:28.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 41b3e90442c97e40abdf29d8b7ecedea1026a1fb4dbd6d6cc410d3f3463cb205",
|
|
"pattern": "[file:hashes.MD5 = 'aef91731409b82100f7129c236869da8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a81-7780-4597-8e30-43b502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:29.000Z",
|
|
"modified": "2017-04-07T10:31:29.000Z",
|
|
"first_observed": "2017-04-07T10:31:29Z",
|
|
"last_observed": "2017-04-07T10:31:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a81-7780-4597-8e30-43b502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a81-7780-4597-8e30-43b502de0b81",
|
|
"value": "https://www.virustotal.com/file/41b3e90442c97e40abdf29d8b7ecedea1026a1fb4dbd6d6cc410d3f3463cb205/analysis/1491513997/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a82-2528-4927-8a4d-420102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:30.000Z",
|
|
"modified": "2017-04-07T10:31:30.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 368845729255ab7fcfb5c0b6c153929d5ccb8d1f9a40cc02ca7c026b4b6813ec",
|
|
"pattern": "[file:hashes.SHA1 = '5bd9f97693d050f013fb02850874c21a967d7138']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a82-8754-4115-bd03-45f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:30.000Z",
|
|
"modified": "2017-04-07T10:31:30.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 368845729255ab7fcfb5c0b6c153929d5ccb8d1f9a40cc02ca7c026b4b6813ec",
|
|
"pattern": "[file:hashes.MD5 = '789ed8c1e3f9b1a77a5b6a43c09d2590']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a83-ea84-4800-934a-47f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:31.000Z",
|
|
"modified": "2017-04-07T10:31:31.000Z",
|
|
"first_observed": "2017-04-07T10:31:31Z",
|
|
"last_observed": "2017-04-07T10:31:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a83-ea84-4800-934a-47f202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a83-ea84-4800-934a-47f202de0b81",
|
|
"value": "https://www.virustotal.com/file/368845729255ab7fcfb5c0b6c153929d5ccb8d1f9a40cc02ca7c026b4b6813ec/analysis/1491513997/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a84-15f8-4337-82df-43e002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:32.000Z",
|
|
"modified": "2017-04-07T10:31:32.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2fac7aab5c3b922b883941fa67fdd7c197e6aaef429e723dccb3fc2150083c8d",
|
|
"pattern": "[file:hashes.SHA1 = '2ef768b07432f8d1cf295ce8c376c0bebc095a51']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a85-684c-45a8-862c-4fc302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:33.000Z",
|
|
"modified": "2017-04-07T10:31:33.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2fac7aab5c3b922b883941fa67fdd7c197e6aaef429e723dccb3fc2150083c8d",
|
|
"pattern": "[file:hashes.MD5 = '206a6e7d382d792551cfcd8110c00f39']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a86-27f0-4f2c-b362-4d4302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:34.000Z",
|
|
"modified": "2017-04-07T10:31:34.000Z",
|
|
"first_observed": "2017-04-07T10:31:34Z",
|
|
"last_observed": "2017-04-07T10:31:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a86-27f0-4f2c-b362-4d4302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a86-27f0-4f2c-b362-4d4302de0b81",
|
|
"value": "https://www.virustotal.com/file/2fac7aab5c3b922b883941fa67fdd7c197e6aaef429e723dccb3fc2150083c8d/analysis/1491513996/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a87-f008-4447-9b2b-44df02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:35.000Z",
|
|
"modified": "2017-04-07T10:31:35.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: eb5e920dd1e2b2df4cede82d0efbda1556fa35ac1c4589533fca58832fd07a62",
|
|
"pattern": "[file:hashes.SHA1 = 'f4c990ebd6c9ed1b961875c2af65409cd9ebf533']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a88-6e90-41c8-b050-4fe002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:36.000Z",
|
|
"modified": "2017-04-07T10:31:36.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: eb5e920dd1e2b2df4cede82d0efbda1556fa35ac1c4589533fca58832fd07a62",
|
|
"pattern": "[file:hashes.MD5 = '304bf45f84b6e5659babb1dd5108d6e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a89-bc34-488d-ba95-4c8102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:37.000Z",
|
|
"modified": "2017-04-07T10:31:37.000Z",
|
|
"first_observed": "2017-04-07T10:31:37Z",
|
|
"last_observed": "2017-04-07T10:31:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a89-bc34-488d-ba95-4c8102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a89-bc34-488d-ba95-4c8102de0b81",
|
|
"value": "https://www.virustotal.com/file/eb5e920dd1e2b2df4cede82d0efbda1556fa35ac1c4589533fca58832fd07a62/analysis/1491513997/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a8a-2ebc-4e16-9119-493f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:38.000Z",
|
|
"modified": "2017-04-07T10:31:38.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8f1ff9588630c3bc017468ff0eadb69c65cf77aae47a148e132eb4b48ae5c988",
|
|
"pattern": "[file:hashes.SHA1 = '89cb36282f8007992ba7c2b31dc0495448bfb630']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a8a-783c-4fde-af56-4c5602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:38.000Z",
|
|
"modified": "2017-04-07T10:31:38.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 8f1ff9588630c3bc017468ff0eadb69c65cf77aae47a148e132eb4b48ae5c988",
|
|
"pattern": "[file:hashes.MD5 = '82630eb054431d84420e8cec59370741']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a8b-2f48-4f4b-9bdd-453c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:39.000Z",
|
|
"modified": "2017-04-07T10:31:39.000Z",
|
|
"first_observed": "2017-04-07T10:31:39Z",
|
|
"last_observed": "2017-04-07T10:31:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a8b-2f48-4f4b-9bdd-453c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a8b-2f48-4f4b-9bdd-453c02de0b81",
|
|
"value": "https://www.virustotal.com/file/8f1ff9588630c3bc017468ff0eadb69c65cf77aae47a148e132eb4b48ae5c988/analysis/1487762811/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a8c-6e68-48ef-920d-49af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:40.000Z",
|
|
"modified": "2017-04-07T10:31:40.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1e5739d640e24504a5e03d0847ad720622c64d0effcd2e1b80528a055049ca82",
|
|
"pattern": "[file:hashes.SHA1 = 'e9017f6350632b99859fe37104fc2609eb1c82f4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a8d-b81c-4ab0-85fb-413b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:41.000Z",
|
|
"modified": "2017-04-07T10:31:41.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 1e5739d640e24504a5e03d0847ad720622c64d0effcd2e1b80528a055049ca82",
|
|
"pattern": "[file:hashes.MD5 = '071373765a35fd03bd6d61fd1dfe505b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a8e-e610-453a-b28c-49a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:42.000Z",
|
|
"modified": "2017-04-07T10:31:42.000Z",
|
|
"first_observed": "2017-04-07T10:31:42Z",
|
|
"last_observed": "2017-04-07T10:31:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a8e-e610-453a-b28c-49a602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a8e-e610-453a-b28c-49a602de0b81",
|
|
"value": "https://www.virustotal.com/file/1e5739d640e24504a5e03d0847ad720622c64d0effcd2e1b80528a055049ca82/analysis/1491513996/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a8f-4638-482e-816d-4ae902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:43.000Z",
|
|
"modified": "2017-04-07T10:31:43.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 15e3cd8a698d30ac7851b3232f8b7cbc7fbbb821c9eece34ef327b67dc281883",
|
|
"pattern": "[file:hashes.SHA1 = 'b31667a0c6a775cfa9fe90389bc28a0f4edcc8c1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a90-03f8-4049-980a-46f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:44.000Z",
|
|
"modified": "2017-04-07T10:31:44.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 15e3cd8a698d30ac7851b3232f8b7cbc7fbbb821c9eece34ef327b67dc281883",
|
|
"pattern": "[file:hashes.MD5 = '1aeea730e836f9ae71f2d252d8621f97']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a90-0c10-4602-a95d-439702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:44.000Z",
|
|
"modified": "2017-04-07T10:31:44.000Z",
|
|
"first_observed": "2017-04-07T10:31:44Z",
|
|
"last_observed": "2017-04-07T10:31:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a90-0c10-4602-a95d-439702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a90-0c10-4602-a95d-439702de0b81",
|
|
"value": "https://www.virustotal.com/file/15e3cd8a698d30ac7851b3232f8b7cbc7fbbb821c9eece34ef327b67dc281883/analysis/1491513996/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a91-f280-4897-a087-41cf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:45.000Z",
|
|
"modified": "2017-04-07T10:31:45.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 579cf5f112c5b542f7240e200fec6312983255b497c6f0a65f2fe2d3b78391c5",
|
|
"pattern": "[file:hashes.SHA1 = '9aec3eac003e3ce211284abcc6ad83bb39652033']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a92-f390-4ca1-a922-468902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:46.000Z",
|
|
"modified": "2017-04-07T10:31:46.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 579cf5f112c5b542f7240e200fec6312983255b497c6f0a65f2fe2d3b78391c5",
|
|
"pattern": "[file:hashes.MD5 = '47430323db04c1b86b46e65e26ba72d2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a93-6ef4-48b9-8e4c-4d0c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:47.000Z",
|
|
"modified": "2017-04-07T10:31:47.000Z",
|
|
"first_observed": "2017-04-07T10:31:47Z",
|
|
"last_observed": "2017-04-07T10:31:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a93-6ef4-48b9-8e4c-4d0c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a93-6ef4-48b9-8e4c-4d0c02de0b81",
|
|
"value": "https://www.virustotal.com/file/579cf5f112c5b542f7240e200fec6312983255b497c6f0a65f2fe2d3b78391c5/analysis/1491513996/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a94-a938-46c5-a4a9-4c2802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:48.000Z",
|
|
"modified": "2017-04-07T10:31:48.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 15c9dc07d2858f496ea7f4110a13e58e6828fe836704582dbbdc630df18d3de5",
|
|
"pattern": "[file:hashes.SHA1 = '3b0407b2ca30a2d75ac0f1ba795d52b4eabcf0a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a95-c998-4dcf-a2f9-490802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:49.000Z",
|
|
"modified": "2017-04-07T10:31:49.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 15c9dc07d2858f496ea7f4110a13e58e6828fe836704582dbbdc630df18d3de5",
|
|
"pattern": "[file:hashes.MD5 = '869eeb38d25a9366a3a5d62d1b15d940']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a96-a0a0-4dc4-8c2a-475202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:50.000Z",
|
|
"modified": "2017-04-07T10:31:50.000Z",
|
|
"first_observed": "2017-04-07T10:31:50Z",
|
|
"last_observed": "2017-04-07T10:31:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a96-a0a0-4dc4-8c2a-475202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a96-a0a0-4dc4-8c2a-475202de0b81",
|
|
"value": "https://www.virustotal.com/file/15c9dc07d2858f496ea7f4110a13e58e6828fe836704582dbbdc630df18d3de5/analysis/1491513995/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a97-dca0-4162-b6d5-4c9002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:51.000Z",
|
|
"modified": "2017-04-07T10:31:51.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2fc2263416b3b55e1dfe67ab6435eed00a74a82e3fbdfdbb6a3a102a7f404641",
|
|
"pattern": "[file:hashes.SHA1 = '6d966be48a41aa18fb05157166aaebb5180c77f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a97-a324-4b8c-9338-43e102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:51.000Z",
|
|
"modified": "2017-04-07T10:31:51.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 2fc2263416b3b55e1dfe67ab6435eed00a74a82e3fbdfdbb6a3a102a7f404641",
|
|
"pattern": "[file:hashes.MD5 = '42cbf5a26fe6ca3a0789de502d107a39']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a98-e038-42df-9020-441b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:52.000Z",
|
|
"modified": "2017-04-07T10:31:52.000Z",
|
|
"first_observed": "2017-04-07T10:31:52Z",
|
|
"last_observed": "2017-04-07T10:31:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a98-e038-42df-9020-441b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a98-e038-42df-9020-441b02de0b81",
|
|
"value": "https://www.virustotal.com/file/2fc2263416b3b55e1dfe67ab6435eed00a74a82e3fbdfdbb6a3a102a7f404641/analysis/1491513995/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a99-f808-40c6-ac19-43b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:53.000Z",
|
|
"modified": "2017-04-07T10:31:53.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: ca438526ad398f240d3ba551cdd59ada402a6270755c4b0750bc0b120e058320",
|
|
"pattern": "[file:hashes.SHA1 = '1aedffefe2f3321757959cd778667e5c78a36361']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a9a-326c-44a1-b991-4bf902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:54.000Z",
|
|
"modified": "2017-04-07T10:31:54.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: ca438526ad398f240d3ba551cdd59ada402a6270755c4b0750bc0b120e058320",
|
|
"pattern": "[file:hashes.MD5 = '8868202fa4fa91dba59516fbba23e296']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a9b-8078-4f1e-b173-4bd902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:55.000Z",
|
|
"modified": "2017-04-07T10:31:55.000Z",
|
|
"first_observed": "2017-04-07T10:31:55Z",
|
|
"last_observed": "2017-04-07T10:31:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a9b-8078-4f1e-b173-4bd902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a9b-8078-4f1e-b173-4bd902de0b81",
|
|
"value": "https://www.virustotal.com/file/ca438526ad398f240d3ba551cdd59ada402a6270755c4b0750bc0b120e058320/analysis/1491513995/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a9c-8d70-4d23-a546-478a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:56.000Z",
|
|
"modified": "2017-04-07T10:31:56.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cdada29d7cd7d88a49a4475a50ee0401d11e2d9a61c4396a60ab0a2fb3da0d01",
|
|
"pattern": "[file:hashes.SHA1 = '8ef1a2e557f78440ead57378776a47088d9ed837']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a9d-9eac-4efd-80dc-417002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:57.000Z",
|
|
"modified": "2017-04-07T10:31:57.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: cdada29d7cd7d88a49a4475a50ee0401d11e2d9a61c4396a60ab0a2fb3da0d01",
|
|
"pattern": "[file:hashes.MD5 = 'f046ac1705e31f5d7654e6ba0b5ae772']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76a9d-f9bc-4aaa-9b06-45b702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:57.000Z",
|
|
"modified": "2017-04-07T10:31:57.000Z",
|
|
"first_observed": "2017-04-07T10:31:57Z",
|
|
"last_observed": "2017-04-07T10:31:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76a9d-f9bc-4aaa-9b06-45b702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76a9d-f9bc-4aaa-9b06-45b702de0b81",
|
|
"value": "https://www.virustotal.com/file/cdada29d7cd7d88a49a4475a50ee0401d11e2d9a61c4396a60ab0a2fb3da0d01/analysis/1491513995/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a9e-fb98-4850-a22d-453302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:58.000Z",
|
|
"modified": "2017-04-07T10:31:58.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b08b96eb46b65af20688c3910a8edcc7dd072a5149ca4b541183acfa81220b97",
|
|
"pattern": "[file:hashes.SHA1 = '2ec826eb11fa03d676d99039b8553e530ea2a965']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76a9f-8874-41f9-bc29-4db802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:31:59.000Z",
|
|
"modified": "2017-04-07T10:31:59.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: b08b96eb46b65af20688c3910a8edcc7dd072a5149ca4b541183acfa81220b97",
|
|
"pattern": "[file:hashes.MD5 = '0eba499c6dd0bcf26bb818e0c916b76c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:31:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aa0-d760-4077-a445-41f902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:00.000Z",
|
|
"modified": "2017-04-07T10:32:00.000Z",
|
|
"first_observed": "2017-04-07T10:32:00Z",
|
|
"last_observed": "2017-04-07T10:32:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aa0-d760-4077-a445-41f902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aa0-d760-4077-a445-41f902de0b81",
|
|
"value": "https://www.virustotal.com/file/b08b96eb46b65af20688c3910a8edcc7dd072a5149ca4b541183acfa81220b97/analysis/1491513994/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa1-40e4-4d81-9580-4b5f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:01.000Z",
|
|
"modified": "2017-04-07T10:32:01.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e2ac3cf79e7267d2e088c3a269aa84fc71fc6073019abb94d16a024d3ad16f3e",
|
|
"pattern": "[file:hashes.SHA1 = 'c5985e239198d1aaa0a8b566bb5d5c204daa2bae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa2-4560-418e-986e-444f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:02.000Z",
|
|
"modified": "2017-04-07T10:32:02.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e2ac3cf79e7267d2e088c3a269aa84fc71fc6073019abb94d16a024d3ad16f3e",
|
|
"pattern": "[file:hashes.MD5 = '059a50b5c1bb8bc7944d897984dfb784']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aa3-2ccc-405b-aae7-439a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:03.000Z",
|
|
"modified": "2017-04-07T10:32:03.000Z",
|
|
"first_observed": "2017-04-07T10:32:03Z",
|
|
"last_observed": "2017-04-07T10:32:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aa3-2ccc-405b-aae7-439a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aa3-2ccc-405b-aae7-439a02de0b81",
|
|
"value": "https://www.virustotal.com/file/e2ac3cf79e7267d2e088c3a269aa84fc71fc6073019abb94d16a024d3ad16f3e/analysis/1491513994/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa4-23c4-4bc1-9e65-4d9b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:04.000Z",
|
|
"modified": "2017-04-07T10:32:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e3963ee9bf892d3f3eea0620585e2e773a30cf536c73a01dd51d6ce36f4daf5d",
|
|
"pattern": "[file:hashes.SHA1 = 'c67da9b26689920c3c4650c27cfe7af8a967b8d6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa4-4d10-44be-8529-4a7302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:04.000Z",
|
|
"modified": "2017-04-07T10:32:04.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: e3963ee9bf892d3f3eea0620585e2e773a30cf536c73a01dd51d6ce36f4daf5d",
|
|
"pattern": "[file:hashes.MD5 = '679a56919384a182d633035bc7607f89']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aa5-6e58-4081-964e-4e1f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:05.000Z",
|
|
"modified": "2017-04-07T10:32:05.000Z",
|
|
"first_observed": "2017-04-07T10:32:05Z",
|
|
"last_observed": "2017-04-07T10:32:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aa5-6e58-4081-964e-4e1f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aa5-6e58-4081-964e-4e1f02de0b81",
|
|
"value": "https://www.virustotal.com/file/e3963ee9bf892d3f3eea0620585e2e773a30cf536c73a01dd51d6ce36f4daf5d/analysis/1491513993/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa6-c380-480e-8667-439802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:06.000Z",
|
|
"modified": "2017-04-07T10:32:06.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: f70681c7e8ab419fd0938802a823337abad936cccc0ace9ee232f2b874e561f1",
|
|
"pattern": "[file:hashes.SHA1 = 'd281b205d06908ab617bcc3a8fab35313c1a3fd4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa7-a398-42d9-b917-458402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:07.000Z",
|
|
"modified": "2017-04-07T10:32:07.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: f70681c7e8ab419fd0938802a823337abad936cccc0ace9ee232f2b874e561f1",
|
|
"pattern": "[file:hashes.MD5 = '1b89ac0f5b4ce671e818c87de26938ad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aa8-dc0c-4081-b074-454102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:08.000Z",
|
|
"modified": "2017-04-07T10:32:08.000Z",
|
|
"first_observed": "2017-04-07T10:32:08Z",
|
|
"last_observed": "2017-04-07T10:32:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aa8-dc0c-4081-b074-454102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aa8-dc0c-4081-b074-454102de0b81",
|
|
"value": "https://www.virustotal.com/file/f70681c7e8ab419fd0938802a823337abad936cccc0ace9ee232f2b874e561f1/analysis/1491513993/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aa9-eab4-4402-8634-4fc002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:09.000Z",
|
|
"modified": "2017-04-07T10:32:09.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a627d2bff74ce07a619cc8fd36294f66eab94b92d41e50b06e63d736ffafd254",
|
|
"pattern": "[file:hashes.SHA1 = '6ecb6a5eed63989e402a477154b19c596247231f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aaa-4594-4b5a-9d82-40b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:10.000Z",
|
|
"modified": "2017-04-07T10:32:10.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: a627d2bff74ce07a619cc8fd36294f66eab94b92d41e50b06e63d736ffafd254",
|
|
"pattern": "[file:hashes.MD5 = '5040d49c11069c43a15cf4d3921b5218']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aaa-d1bc-434d-99ae-481002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:10.000Z",
|
|
"modified": "2017-04-07T10:32:10.000Z",
|
|
"first_observed": "2017-04-07T10:32:10Z",
|
|
"last_observed": "2017-04-07T10:32:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aaa-d1bc-434d-99ae-481002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aaa-d1bc-434d-99ae-481002de0b81",
|
|
"value": "https://www.virustotal.com/file/a627d2bff74ce07a619cc8fd36294f66eab94b92d41e50b06e63d736ffafd254/analysis/1491513993/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aab-7f7c-4487-a100-450202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:11.000Z",
|
|
"modified": "2017-04-07T10:32:11.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: c9e55094b84a06b3a40b7df1cd76fc287fdc02a2cdd30af359743bbc23475917",
|
|
"pattern": "[file:hashes.SHA1 = 'b051f935b9831f0547f11b1b03636574e2e7eed4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aac-91d0-4ad4-87ba-453b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:12.000Z",
|
|
"modified": "2017-04-07T10:32:12.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: c9e55094b84a06b3a40b7df1cd76fc287fdc02a2cdd30af359743bbc23475917",
|
|
"pattern": "[file:hashes.MD5 = 'a0582988c774eebeeba2798ccb04b27f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aad-e5b8-4560-ab5c-44f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:13.000Z",
|
|
"modified": "2017-04-07T10:32:13.000Z",
|
|
"first_observed": "2017-04-07T10:32:13Z",
|
|
"last_observed": "2017-04-07T10:32:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aad-e5b8-4560-ab5c-44f002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aad-e5b8-4560-ab5c-44f002de0b81",
|
|
"value": "https://www.virustotal.com/file/c9e55094b84a06b3a40b7df1cd76fc287fdc02a2cdd30af359743bbc23475917/analysis/1491513994/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aae-23dc-43d9-b659-4e1902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:14.000Z",
|
|
"modified": "2017-04-07T10:32:14.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 453b9f7aed67f41ec192db3011459e2dd865bb729265c544ee1b8814c6e7dc53",
|
|
"pattern": "[file:hashes.SHA1 = 'b7ac25c7d9fbbe4a6597937e4c642ad0358098b0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aaf-d9d8-4b52-b5d5-406102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:15.000Z",
|
|
"modified": "2017-04-07T10:32:15.000Z",
|
|
"description": "MICROPSIA - Xchecked via VT: 453b9f7aed67f41ec192db3011459e2dd865bb729265c544ee1b8814c6e7dc53",
|
|
"pattern": "[file:hashes.MD5 = '4c1eec2b9b6eefa49ff9f5fd87e77482']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ab0-dfa4-41c1-a2a6-422602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:16.000Z",
|
|
"modified": "2017-04-07T10:32:16.000Z",
|
|
"first_observed": "2017-04-07T10:32:16Z",
|
|
"last_observed": "2017-04-07T10:32:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ab0-dfa4-41c1-a2a6-422602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ab0-dfa4-41c1-a2a6-422602de0b81",
|
|
"value": "https://www.virustotal.com/file/453b9f7aed67f41ec192db3011459e2dd865bb729265c544ee1b8814c6e7dc53/analysis/1491513993/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab0-2f80-4caf-b6fa-4d1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:16.000Z",
|
|
"modified": "2017-04-07T10:32:16.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5ba356e5e96ce8b9cbccdcb11d817bb53924afdb7e3af72155898fc7bfae0920",
|
|
"pattern": "[file:hashes.SHA1 = '84b37b0efc31f0a97bc61696799696edc844908a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab1-1db0-4b5b-9f65-48b402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:17.000Z",
|
|
"modified": "2017-04-07T10:32:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5ba356e5e96ce8b9cbccdcb11d817bb53924afdb7e3af72155898fc7bfae0920",
|
|
"pattern": "[file:hashes.MD5 = '8a574181ed2efe4c2b02efd9a4ac0ece']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ab2-d35c-4b4d-a45d-4c1e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:18.000Z",
|
|
"modified": "2017-04-07T10:32:18.000Z",
|
|
"first_observed": "2017-04-07T10:32:18Z",
|
|
"last_observed": "2017-04-07T10:32:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ab2-d35c-4b4d-a45d-4c1e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ab2-d35c-4b4d-a45d-4c1e02de0b81",
|
|
"value": "https://www.virustotal.com/file/5ba356e5e96ce8b9cbccdcb11d817bb53924afdb7e3af72155898fc7bfae0920/analysis/1442980448/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab3-1e04-45f1-a0f0-417c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:19.000Z",
|
|
"modified": "2017-04-07T10:32:19.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f7bd43323917ce3ce71da472593e0899dd54ce957e2621083a29680a04a263e8",
|
|
"pattern": "[file:hashes.SHA1 = 'd12728d03e6c936f738592948ee1c0be89f950c1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab4-9f80-4378-9e65-47d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:20.000Z",
|
|
"modified": "2017-04-07T10:32:20.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f7bd43323917ce3ce71da472593e0899dd54ce957e2621083a29680a04a263e8",
|
|
"pattern": "[file:hashes.MD5 = '440bb797002b2cae03987f7395405795']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ab5-3030-495d-9e77-436802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:21.000Z",
|
|
"modified": "2017-04-07T10:32:21.000Z",
|
|
"first_observed": "2017-04-07T10:32:21Z",
|
|
"last_observed": "2017-04-07T10:32:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ab5-3030-495d-9e77-436802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ab5-3030-495d-9e77-436802de0b81",
|
|
"value": "https://www.virustotal.com/file/f7bd43323917ce3ce71da472593e0899dd54ce957e2621083a29680a04a263e8/analysis/1491513992/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab6-814c-4216-aa49-4be502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:22.000Z",
|
|
"modified": "2017-04-07T10:32:22.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 874febea579812e0fbbc3dc1e591264108e61864c48f9b8e15fc9644edee0621",
|
|
"pattern": "[file:hashes.SHA1 = '4958dd47081632be117425408e11aca956759b7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab7-395c-42df-8bbe-4ffc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:23.000Z",
|
|
"modified": "2017-04-07T10:32:23.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 874febea579812e0fbbc3dc1e591264108e61864c48f9b8e15fc9644edee0621",
|
|
"pattern": "[file:hashes.MD5 = 'f1105cb2d34b0b98f8298584c11f66dc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ab8-02e4-45b5-8505-4afa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:24.000Z",
|
|
"modified": "2017-04-07T10:32:24.000Z",
|
|
"first_observed": "2017-04-07T10:32:24Z",
|
|
"last_observed": "2017-04-07T10:32:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ab8-02e4-45b5-8505-4afa02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ab8-02e4-45b5-8505-4afa02de0b81",
|
|
"value": "https://www.virustotal.com/file/874febea579812e0fbbc3dc1e591264108e61864c48f9b8e15fc9644edee0621/analysis/1491513992/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab9-2d64-4235-b9a8-4cb402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:25.000Z",
|
|
"modified": "2017-04-07T10:32:25.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a136bc03de8cf0b99b8aa500460a8be6aa1c98ce78515c217ad03d6faa9e08f1",
|
|
"pattern": "[file:hashes.SHA1 = '500391de2c10d919bc2a51f4e2f351a88fbff45f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ab9-b484-4342-ba9f-4dc502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:25.000Z",
|
|
"modified": "2017-04-07T10:32:25.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a136bc03de8cf0b99b8aa500460a8be6aa1c98ce78515c217ad03d6faa9e08f1",
|
|
"pattern": "[file:hashes.MD5 = '52b32d172579640474a4537744fc522e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aba-e980-45a8-9486-406202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:26.000Z",
|
|
"modified": "2017-04-07T10:32:26.000Z",
|
|
"first_observed": "2017-04-07T10:32:26Z",
|
|
"last_observed": "2017-04-07T10:32:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aba-e980-45a8-9486-406202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aba-e980-45a8-9486-406202de0b81",
|
|
"value": "https://www.virustotal.com/file/a136bc03de8cf0b99b8aa500460a8be6aa1c98ce78515c217ad03d6faa9e08f1/analysis/1491499746/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76abb-67dc-4fbe-996a-4e4802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:27.000Z",
|
|
"modified": "2017-04-07T10:32:27.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 31a4d2f12b5e8ab7ca06a61dc117cc5742ea222e3101e495b60f4c289f14b547",
|
|
"pattern": "[file:hashes.SHA1 = 'f8e4d7e005d965f37b156b940e5d59bdd030ccad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76abc-8d34-4f19-bca7-4d5d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:28.000Z",
|
|
"modified": "2017-04-07T10:32:28.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 31a4d2f12b5e8ab7ca06a61dc117cc5742ea222e3101e495b60f4c289f14b547",
|
|
"pattern": "[file:hashes.MD5 = 'd1f1a0c736e5f7867802aa7fbba9f35f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76abd-ede0-4dc6-8dc2-472002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:29.000Z",
|
|
"modified": "2017-04-07T10:32:29.000Z",
|
|
"first_observed": "2017-04-07T10:32:29Z",
|
|
"last_observed": "2017-04-07T10:32:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76abd-ede0-4dc6-8dc2-472002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76abd-ede0-4dc6-8dc2-472002de0b81",
|
|
"value": "https://www.virustotal.com/file/31a4d2f12b5e8ab7ca06a61dc117cc5742ea222e3101e495b60f4c289f14b547/analysis/1491499708/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76abe-ed70-4d93-9a91-4b0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:30.000Z",
|
|
"modified": "2017-04-07T10:32:30.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1c1d858934f278abac6bce5f609db8649d58ceaada00f661b6e18b0dd13946b0",
|
|
"pattern": "[file:hashes.SHA1 = '644597530e0a45baeb049a6fb8ba7fe2b43434bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76abf-efa0-47c8-9530-46da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:31.000Z",
|
|
"modified": "2017-04-07T10:32:31.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1c1d858934f278abac6bce5f609db8649d58ceaada00f661b6e18b0dd13946b0",
|
|
"pattern": "[file:hashes.MD5 = '0b0d561d832e7382d9b6b73aada91a96']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ac0-5aec-4583-90e1-453d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:32.000Z",
|
|
"modified": "2017-04-07T10:32:32.000Z",
|
|
"first_observed": "2017-04-07T10:32:32Z",
|
|
"last_observed": "2017-04-07T10:32:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ac0-5aec-4583-90e1-453d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ac0-5aec-4583-90e1-453d02de0b81",
|
|
"value": "https://www.virustotal.com/file/1c1d858934f278abac6bce5f609db8649d58ceaada00f661b6e18b0dd13946b0/analysis/1491513991/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac0-0964-4a32-b22f-440b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:32.000Z",
|
|
"modified": "2017-04-07T10:32:32.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2c0ba35cdc0ef302fc52aef368565b61edbf9c7a962661cafa4b2cfc26eda371",
|
|
"pattern": "[file:hashes.SHA1 = 'cee3f1806695b561c812e077689f14ad13031cfa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac1-4234-46a0-8ff6-486002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:33.000Z",
|
|
"modified": "2017-04-07T10:32:33.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2c0ba35cdc0ef302fc52aef368565b61edbf9c7a962661cafa4b2cfc26eda371",
|
|
"pattern": "[file:hashes.MD5 = 'c01b725e0cb4ea76cc9d70ef2301622f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ac2-40c4-4eca-894b-4eb702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:34.000Z",
|
|
"modified": "2017-04-07T10:32:34.000Z",
|
|
"first_observed": "2017-04-07T10:32:34Z",
|
|
"last_observed": "2017-04-07T10:32:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ac2-40c4-4eca-894b-4eb702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ac2-40c4-4eca-894b-4eb702de0b81",
|
|
"value": "https://www.virustotal.com/file/2c0ba35cdc0ef302fc52aef368565b61edbf9c7a962661cafa4b2cfc26eda371/analysis/1439884688/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac3-a1b0-4ba2-ab41-444902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:35.000Z",
|
|
"modified": "2017-04-07T10:32:35.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e75d209025a34fda854cb9289c1f329671fe010ba6616e24c0338eb9f17266c9",
|
|
"pattern": "[file:hashes.SHA1 = '14ccfea7689b6f1b71a9f7b3cac8901abd6c5c8a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac4-2560-4ee5-ac9a-4a9502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:36.000Z",
|
|
"modified": "2017-04-07T10:32:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e75d209025a34fda854cb9289c1f329671fe010ba6616e24c0338eb9f17266c9",
|
|
"pattern": "[file:hashes.MD5 = 'aa565dabb57563bb9c1310bd239c18cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ac5-a648-439e-9034-4d0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:37.000Z",
|
|
"modified": "2017-04-07T10:32:37.000Z",
|
|
"first_observed": "2017-04-07T10:32:37Z",
|
|
"last_observed": "2017-04-07T10:32:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ac5-a648-439e-9034-4d0f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ac5-a648-439e-9034-4d0f02de0b81",
|
|
"value": "https://www.virustotal.com/file/e75d209025a34fda854cb9289c1f329671fe010ba6616e24c0338eb9f17266c9/analysis/1491417642/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac6-96bc-4480-872a-403e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:38.000Z",
|
|
"modified": "2017-04-07T10:32:38.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c5fc26f84955a041de20f3ff2ee04a59f9d8a2ab5d6c4702b8da0cf03b4147ef",
|
|
"pattern": "[file:hashes.SHA1 = 'ed381c1c9350673f1d1f6cb7f16e8a255f74c954']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac7-8b68-4ef9-87dd-481102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:39.000Z",
|
|
"modified": "2017-04-07T10:32:39.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c5fc26f84955a041de20f3ff2ee04a59f9d8a2ab5d6c4702b8da0cf03b4147ef",
|
|
"pattern": "[file:hashes.MD5 = '86ea790bee92bf054a245d07a3bfa02c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ac7-72a0-4d5e-a73d-498b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:39.000Z",
|
|
"modified": "2017-04-07T10:32:39.000Z",
|
|
"first_observed": "2017-04-07T10:32:39Z",
|
|
"last_observed": "2017-04-07T10:32:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ac7-72a0-4d5e-a73d-498b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ac7-72a0-4d5e-a73d-498b02de0b81",
|
|
"value": "https://www.virustotal.com/file/c5fc26f84955a041de20f3ff2ee04a59f9d8a2ab5d6c4702b8da0cf03b4147ef/analysis/1445946582/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac8-8098-4fc8-a837-4e7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:40.000Z",
|
|
"modified": "2017-04-07T10:32:40.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 8ee8572d912eca16470679fcd4d98e6e22e4446c2dd74d5d96f1056ce3a93e22",
|
|
"pattern": "[file:hashes.SHA1 = '9d8046ed61c5e72b73f55d7e8d4826f55f637931']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ac9-44e0-4ce1-8777-48dc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:41.000Z",
|
|
"modified": "2017-04-07T10:32:41.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 8ee8572d912eca16470679fcd4d98e6e22e4446c2dd74d5d96f1056ce3a93e22",
|
|
"pattern": "[file:hashes.MD5 = 'b607580b0c5f463d7ac54fc500a4f298']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aca-496c-4a43-a62c-40b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:42.000Z",
|
|
"modified": "2017-04-07T10:32:42.000Z",
|
|
"first_observed": "2017-04-07T10:32:42Z",
|
|
"last_observed": "2017-04-07T10:32:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aca-496c-4a43-a62c-40b902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aca-496c-4a43-a62c-40b902de0b81",
|
|
"value": "https://www.virustotal.com/file/8ee8572d912eca16470679fcd4d98e6e22e4446c2dd74d5d96f1056ce3a93e22/analysis/1491499645/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76acb-a76c-4ff3-ae2e-44e002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:43.000Z",
|
|
"modified": "2017-04-07T10:32:43.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 42e8118271ce2df0a3313e271d8a86f425bdcd15e1b5bd6c6239701cfad6da3f",
|
|
"pattern": "[file:hashes.SHA1 = '353731cd622b02d58602ac95dfd921ecdb06dd2b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76acd-b184-4aa5-8c06-439802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:45.000Z",
|
|
"modified": "2017-04-07T10:32:45.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 42e8118271ce2df0a3313e271d8a86f425bdcd15e1b5bd6c6239701cfad6da3f",
|
|
"pattern": "[file:hashes.MD5 = '1e4d141f50380c3dd83885e00081a2f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ace-4ee0-4634-9de8-4f6002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:46.000Z",
|
|
"modified": "2017-04-07T10:32:46.000Z",
|
|
"first_observed": "2017-04-07T10:32:46Z",
|
|
"last_observed": "2017-04-07T10:32:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ace-4ee0-4634-9de8-4f6002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ace-4ee0-4634-9de8-4f6002de0b81",
|
|
"value": "https://www.virustotal.com/file/42e8118271ce2df0a3313e271d8a86f425bdcd15e1b5bd6c6239701cfad6da3f/analysis/1491499548/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76acf-4e50-4828-a427-460802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:47.000Z",
|
|
"modified": "2017-04-07T10:32:47.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5329652e9eb2aa681abc8e69955b24165a23a807a69ae76e67c07d1fdfe8fc38",
|
|
"pattern": "[file:hashes.SHA1 = 'ef34d1036b30b1cc4ba2e7517c449e921d04f214']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad0-2584-4c4d-8c8d-4ca702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:48.000Z",
|
|
"modified": "2017-04-07T10:32:48.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5329652e9eb2aa681abc8e69955b24165a23a807a69ae76e67c07d1fdfe8fc38",
|
|
"pattern": "[file:hashes.MD5 = 'bff8b8c7d07d31c281b504d095ef8de1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ad1-9800-4a13-a0ca-42bf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:49.000Z",
|
|
"modified": "2017-04-07T10:32:49.000Z",
|
|
"first_observed": "2017-04-07T10:32:49Z",
|
|
"last_observed": "2017-04-07T10:32:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ad1-9800-4a13-a0ca-42bf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ad1-9800-4a13-a0ca-42bf02de0b81",
|
|
"value": "https://www.virustotal.com/file/5329652e9eb2aa681abc8e69955b24165a23a807a69ae76e67c07d1fdfe8fc38/analysis/1491499464/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad2-124c-41d3-a7a3-453902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:50.000Z",
|
|
"modified": "2017-04-07T10:32:50.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 81410d2a560984fe41d371bd745f6de9f9f120dc929f439947f3cfc330774a95",
|
|
"pattern": "[file:hashes.SHA1 = '8a1d06d866a3c81492be894c216e5c0296e4b81d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad3-5ed4-4786-a71f-40ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:51.000Z",
|
|
"modified": "2017-04-07T10:32:51.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 81410d2a560984fe41d371bd745f6de9f9f120dc929f439947f3cfc330774a95",
|
|
"pattern": "[file:hashes.MD5 = 'dc59cd0ed1aba2692bad6dfe13bbf8b2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ad4-ab70-4ead-a862-4a5402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:52.000Z",
|
|
"modified": "2017-04-07T10:32:52.000Z",
|
|
"first_observed": "2017-04-07T10:32:52Z",
|
|
"last_observed": "2017-04-07T10:32:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ad4-ab70-4ead-a862-4a5402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ad4-ab70-4ead-a862-4a5402de0b81",
|
|
"value": "https://www.virustotal.com/file/81410d2a560984fe41d371bd745f6de9f9f120dc929f439947f3cfc330774a95/analysis/1491499366/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad5-2e18-4e8c-b259-4dcf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:53.000Z",
|
|
"modified": "2017-04-07T10:32:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 455be9cff65b2178189444572b0a9b31d5cc5b709bcefc7381eaf4b9141ca46f",
|
|
"pattern": "[file:hashes.SHA1 = 'f93a3e0e60ea6c5ac78c37d0ae0a53fb0133aedc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad5-c848-48cc-82f3-451902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:53.000Z",
|
|
"modified": "2017-04-07T10:32:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 455be9cff65b2178189444572b0a9b31d5cc5b709bcefc7381eaf4b9141ca46f",
|
|
"pattern": "[file:hashes.MD5 = '558f4c4f0b03d00625f551e943fb4e11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ad6-a580-4dec-887c-482e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:54.000Z",
|
|
"modified": "2017-04-07T10:32:54.000Z",
|
|
"first_observed": "2017-04-07T10:32:54Z",
|
|
"last_observed": "2017-04-07T10:32:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ad6-a580-4dec-887c-482e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ad6-a580-4dec-887c-482e02de0b81",
|
|
"value": "https://www.virustotal.com/file/455be9cff65b2178189444572b0a9b31d5cc5b709bcefc7381eaf4b9141ca46f/analysis/1491499135/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad7-4af0-451e-aacb-477502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:55.000Z",
|
|
"modified": "2017-04-07T10:32:55.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4550e8b216c2ef7d78be2ef572fefbdde76c0c6640c6c1cb6757a3867a9710d7",
|
|
"pattern": "[file:hashes.SHA1 = '81df2d50984001605f868b2ab9259c40b6c2cfa7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ad8-d6c0-4e9b-b83a-4c6802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:56.000Z",
|
|
"modified": "2017-04-07T10:32:56.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4550e8b216c2ef7d78be2ef572fefbdde76c0c6640c6c1cb6757a3867a9710d7",
|
|
"pattern": "[file:hashes.MD5 = '121e39a5b83376b5e1dc3d3262bffafa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ad9-dc30-42fc-a2e5-43b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:57.000Z",
|
|
"modified": "2017-04-07T10:32:57.000Z",
|
|
"first_observed": "2017-04-07T10:32:57Z",
|
|
"last_observed": "2017-04-07T10:32:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ad9-dc30-42fc-a2e5-43b102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ad9-dc30-42fc-a2e5-43b102de0b81",
|
|
"value": "https://www.virustotal.com/file/4550e8b216c2ef7d78be2ef572fefbdde76c0c6640c6c1cb6757a3867a9710d7/analysis/1452528305/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ada-4afc-4ef4-8072-434f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:58.000Z",
|
|
"modified": "2017-04-07T10:32:58.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 54b07adba4b1fd4467a2cae45480ae8f764866e8ae6bf66150f2cd860b36aaf2",
|
|
"pattern": "[file:hashes.SHA1 = 'a4860fd51c2e387a9613713d12ef5e3276ba31be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76adb-19c4-40c0-a6da-4fee02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:32:59.000Z",
|
|
"modified": "2017-04-07T10:32:59.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 54b07adba4b1fd4467a2cae45480ae8f764866e8ae6bf66150f2cd860b36aaf2",
|
|
"pattern": "[file:hashes.MD5 = '7ada27b89b68bf294f547ed64b45ebc0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:32:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76adc-b70c-4bb9-a952-43ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:00.000Z",
|
|
"modified": "2017-04-07T10:33:00.000Z",
|
|
"first_observed": "2017-04-07T10:33:00Z",
|
|
"last_observed": "2017-04-07T10:33:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76adc-b70c-4bb9-a952-43ad02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76adc-b70c-4bb9-a952-43ad02de0b81",
|
|
"value": "https://www.virustotal.com/file/54b07adba4b1fd4467a2cae45480ae8f764866e8ae6bf66150f2cd860b36aaf2/analysis/1491513987/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76add-1b98-4f6a-8820-428402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:01.000Z",
|
|
"modified": "2017-04-07T10:33:01.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7be574a767acb4fe9a1af425fe1fddcda17a97f4653837384352cebec21801e1",
|
|
"pattern": "[file:hashes.SHA1 = 'b70b88537e0cb9299d988c40530f4595a2449320']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ade-91c0-4910-a327-49f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:02.000Z",
|
|
"modified": "2017-04-07T10:33:02.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7be574a767acb4fe9a1af425fe1fddcda17a97f4653837384352cebec21801e1",
|
|
"pattern": "[file:hashes.MD5 = 'c16ec71e62918453ebc2682ae3181bda']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76adf-8f54-4189-b348-4fe802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:03.000Z",
|
|
"modified": "2017-04-07T10:33:03.000Z",
|
|
"first_observed": "2017-04-07T10:33:03Z",
|
|
"last_observed": "2017-04-07T10:33:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76adf-8f54-4189-b348-4fe802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76adf-8f54-4189-b348-4fe802de0b81",
|
|
"value": "https://www.virustotal.com/file/7be574a767acb4fe9a1af425fe1fddcda17a97f4653837384352cebec21801e1/analysis/1491513987/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae0-7188-42e0-9cc2-4f6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:03.000Z",
|
|
"modified": "2017-04-07T10:33:03.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c24e30b7a32f096bad4385012a1c1b3a61198156b19081f7658a4f1c25d055c4",
|
|
"pattern": "[file:hashes.SHA1 = '4913e69d238e1f7126a976f705a7b63f9bcdde99']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae0-099c-4394-992b-4b3002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:04.000Z",
|
|
"modified": "2017-04-07T10:33:04.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c24e30b7a32f096bad4385012a1c1b3a61198156b19081f7658a4f1c25d055c4",
|
|
"pattern": "[file:hashes.MD5 = 'c6e91b8e890acc9a7d229e25eddd5456']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ae1-971c-4242-8633-497a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:05.000Z",
|
|
"modified": "2017-04-07T10:33:05.000Z",
|
|
"first_observed": "2017-04-07T10:33:05Z",
|
|
"last_observed": "2017-04-07T10:33:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ae1-971c-4242-8633-497a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ae1-971c-4242-8633-497a02de0b81",
|
|
"value": "https://www.virustotal.com/file/c24e30b7a32f096bad4385012a1c1b3a61198156b19081f7658a4f1c25d055c4/analysis/1491513987/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae2-00c8-4cc1-851c-4d7502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:06.000Z",
|
|
"modified": "2017-04-07T10:33:06.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a2e979e03c32e5de9ba34407b37143b6a887ab6f9d8cdcb07a6276f41202dc5d",
|
|
"pattern": "[file:hashes.SHA1 = '6d401e6d5bf3a8b511d9623be4fc845db0536076']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae3-b9a4-4c4a-b676-44f802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:07.000Z",
|
|
"modified": "2017-04-07T10:33:07.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a2e979e03c32e5de9ba34407b37143b6a887ab6f9d8cdcb07a6276f41202dc5d",
|
|
"pattern": "[file:hashes.MD5 = 'a62df9622812975e8286406e4becaf11']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ae4-74b4-4bec-9e97-447002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:08.000Z",
|
|
"modified": "2017-04-07T10:33:08.000Z",
|
|
"first_observed": "2017-04-07T10:33:08Z",
|
|
"last_observed": "2017-04-07T10:33:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ae4-74b4-4bec-9e97-447002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ae4-74b4-4bec-9e97-447002de0b81",
|
|
"value": "https://www.virustotal.com/file/a2e979e03c32e5de9ba34407b37143b6a887ab6f9d8cdcb07a6276f41202dc5d/analysis/1491499034/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae5-c1f8-48bc-bb29-478202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:09.000Z",
|
|
"modified": "2017-04-07T10:33:09.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bb3676b9ea838344e955cf58b01d2df4384f6ba8b62fa00259ab8c449e77f358",
|
|
"pattern": "[file:hashes.SHA1 = '77f6a6844023966a70bf44f3dc5fb0ef5d726d21']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae5-24ac-4689-90f5-47fa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:09.000Z",
|
|
"modified": "2017-04-07T10:33:09.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bb3676b9ea838344e955cf58b01d2df4384f6ba8b62fa00259ab8c449e77f358",
|
|
"pattern": "[file:hashes.MD5 = '11d5c0f9ac173d39d56df971eb39871c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ae6-d60c-49c4-b3ea-4b0002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:10.000Z",
|
|
"modified": "2017-04-07T10:33:10.000Z",
|
|
"first_observed": "2017-04-07T10:33:10Z",
|
|
"last_observed": "2017-04-07T10:33:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ae6-d60c-49c4-b3ea-4b0002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ae6-d60c-49c4-b3ea-4b0002de0b81",
|
|
"value": "https://www.virustotal.com/file/bb3676b9ea838344e955cf58b01d2df4384f6ba8b62fa00259ab8c449e77f358/analysis/1491537958/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae7-3cd8-4540-83e7-4b6b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:11.000Z",
|
|
"modified": "2017-04-07T10:33:11.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2088d5f31b8f8a75464def9b02c159a2a1aa3056fc3c82056272c9b39cea0639",
|
|
"pattern": "[file:hashes.SHA1 = '3d1d3d680ca3fa1af3d972ff18cdccf35731c1e5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ae8-43e8-4b9b-ab11-457902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:12.000Z",
|
|
"modified": "2017-04-07T10:33:12.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2088d5f31b8f8a75464def9b02c159a2a1aa3056fc3c82056272c9b39cea0639",
|
|
"pattern": "[file:hashes.MD5 = 'bcfaa94b32794cb15f2f2ee94e62f8fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ae9-24bc-4784-b800-474402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:13.000Z",
|
|
"modified": "2017-04-07T10:33:13.000Z",
|
|
"first_observed": "2017-04-07T10:33:13Z",
|
|
"last_observed": "2017-04-07T10:33:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ae9-24bc-4784-b800-474402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ae9-24bc-4784-b800-474402de0b81",
|
|
"value": "https://www.virustotal.com/file/2088d5f31b8f8a75464def9b02c159a2a1aa3056fc3c82056272c9b39cea0639/analysis/1491513986/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aea-4d2c-4e8d-84a5-43af02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:14.000Z",
|
|
"modified": "2017-04-07T10:33:14.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 397087699aa240e8a74a687902ad3c8b2a0f1535179fab046673cc1032c72796",
|
|
"pattern": "[file:hashes.SHA1 = '59f82f0c7a2b57addbbe50d6f20343bb8de6bafb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aeb-96b8-49c2-b3a6-48f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:15.000Z",
|
|
"modified": "2017-04-07T10:33:15.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 397087699aa240e8a74a687902ad3c8b2a0f1535179fab046673cc1032c72796",
|
|
"pattern": "[file:hashes.MD5 = 'a43786be4753a8c334fe1a56c6c3cde4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aec-250c-4c44-b3d8-4deb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:16.000Z",
|
|
"modified": "2017-04-07T10:33:16.000Z",
|
|
"first_observed": "2017-04-07T10:33:16Z",
|
|
"last_observed": "2017-04-07T10:33:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aec-250c-4c44-b3d8-4deb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aec-250c-4c44-b3d8-4deb02de0b81",
|
|
"value": "https://www.virustotal.com/file/397087699aa240e8a74a687902ad3c8b2a0f1535179fab046673cc1032c72796/analysis/1462169467/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aee-2218-4428-b415-45fe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:17.000Z",
|
|
"modified": "2017-04-07T10:33:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c1ab9ec3f1d6050a77cc8d976dac441c13ba2fd3c0229076c20a2406258198bf",
|
|
"pattern": "[file:hashes.SHA1 = '5a31f6aff92e15cf36623e1ff37ef9e178dee347']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76aef-b38c-4ecd-ab79-4a5202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:19.000Z",
|
|
"modified": "2017-04-07T10:33:19.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c1ab9ec3f1d6050a77cc8d976dac441c13ba2fd3c0229076c20a2406258198bf",
|
|
"pattern": "[file:hashes.MD5 = 'a2ed15750fb200a5e158adf3930da99a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76af0-8a5c-4cae-a292-4dfb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:20.000Z",
|
|
"modified": "2017-04-07T10:33:20.000Z",
|
|
"first_observed": "2017-04-07T10:33:20Z",
|
|
"last_observed": "2017-04-07T10:33:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76af0-8a5c-4cae-a292-4dfb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76af0-8a5c-4cae-a292-4dfb02de0b81",
|
|
"value": "https://www.virustotal.com/file/c1ab9ec3f1d6050a77cc8d976dac441c13ba2fd3c0229076c20a2406258198bf/analysis/1468277502/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af1-3ec8-415b-889d-429a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:21.000Z",
|
|
"modified": "2017-04-07T10:33:21.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bdb17c29b31fbe557200569f584c589104b52f188799dc5b45a33f3a7a16a34d",
|
|
"pattern": "[file:hashes.SHA1 = '7029d23b95e7263defae8077f2a3ec3f15948920']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af2-8b74-4b64-b332-41ac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:22.000Z",
|
|
"modified": "2017-04-07T10:33:22.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bdb17c29b31fbe557200569f584c589104b52f188799dc5b45a33f3a7a16a34d",
|
|
"pattern": "[file:hashes.MD5 = 'a99fbfe3001f579224467092ffb68a30']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76af3-031c-40bb-8a3d-4ca402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:23.000Z",
|
|
"modified": "2017-04-07T10:33:23.000Z",
|
|
"first_observed": "2017-04-07T10:33:23Z",
|
|
"last_observed": "2017-04-07T10:33:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76af3-031c-40bb-8a3d-4ca402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76af3-031c-40bb-8a3d-4ca402de0b81",
|
|
"value": "https://www.virustotal.com/file/bdb17c29b31fbe557200569f584c589104b52f188799dc5b45a33f3a7a16a34d/analysis/1491513986/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af4-9088-439e-8463-4ff702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:24.000Z",
|
|
"modified": "2017-04-07T10:33:24.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 44d0c56f4037d21b85fe00e944456cf2a67e71ca3133c3afd0ea1f35d29e7b33",
|
|
"pattern": "[file:hashes.SHA1 = 'f5e5b33d3f8548107c4a0dacbc5ba2077001f42f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af5-79a0-45cb-9bea-4af002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:25.000Z",
|
|
"modified": "2017-04-07T10:33:25.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 44d0c56f4037d21b85fe00e944456cf2a67e71ca3133c3afd0ea1f35d29e7b33",
|
|
"pattern": "[file:hashes.MD5 = '129c5c9ee71b9d46fcb9e789900c2394']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76af6-f7a4-4ddb-a920-463e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:26.000Z",
|
|
"modified": "2017-04-07T10:33:26.000Z",
|
|
"first_observed": "2017-04-07T10:33:26Z",
|
|
"last_observed": "2017-04-07T10:33:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76af6-f7a4-4ddb-a920-463e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76af6-f7a4-4ddb-a920-463e02de0b81",
|
|
"value": "https://www.virustotal.com/file/44d0c56f4037d21b85fe00e944456cf2a67e71ca3133c3afd0ea1f35d29e7b33/analysis/1461063306/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af7-d5a4-4e8f-8e5c-40f102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:26.000Z",
|
|
"modified": "2017-04-07T10:33:26.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 30912cc80cf7defaec360cdd08952ceed493e88d87ad705ec80831581c5c867d",
|
|
"pattern": "[file:hashes.SHA1 = '69a5e235bd5a967dc7681965e27a42d91add83e2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76af8-55a0-4ee2-97b0-41a702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:28.000Z",
|
|
"modified": "2017-04-07T10:33:28.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 30912cc80cf7defaec360cdd08952ceed493e88d87ad705ec80831581c5c867d",
|
|
"pattern": "[file:hashes.MD5 = '72cc13ce73c357cab63d6ba491d2d7df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76af9-b584-40c7-ab6e-4f9002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:29.000Z",
|
|
"modified": "2017-04-07T10:33:29.000Z",
|
|
"first_observed": "2017-04-07T10:33:29Z",
|
|
"last_observed": "2017-04-07T10:33:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76af9-b584-40c7-ab6e-4f9002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76af9-b584-40c7-ab6e-4f9002de0b81",
|
|
"value": "https://www.virustotal.com/file/30912cc80cf7defaec360cdd08952ceed493e88d87ad705ec80831581c5c867d/analysis/1461099249/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76afa-b430-4f7c-be63-464f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:30.000Z",
|
|
"modified": "2017-04-07T10:33:30.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4546413de0c2df37c83a88808cebe265dc74dd87c550c378f1d23d8e5430a7db",
|
|
"pattern": "[file:hashes.SHA1 = 'd1d2bbed2f044ca86eda1b4fd3553745ddd5f97f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76afb-e0b8-4fd3-8552-4a4402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:31.000Z",
|
|
"modified": "2017-04-07T10:33:31.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4546413de0c2df37c83a88808cebe265dc74dd87c550c378f1d23d8e5430a7db",
|
|
"pattern": "[file:hashes.MD5 = '271c61699eb2a673b8543e9377ce7a0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76afc-366c-4731-8648-42fe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:32.000Z",
|
|
"modified": "2017-04-07T10:33:32.000Z",
|
|
"first_observed": "2017-04-07T10:33:32Z",
|
|
"last_observed": "2017-04-07T10:33:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76afc-366c-4731-8648-42fe02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76afc-366c-4731-8648-42fe02de0b81",
|
|
"value": "https://www.virustotal.com/file/4546413de0c2df37c83a88808cebe265dc74dd87c550c378f1d23d8e5430a7db/analysis/1462666409/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76afd-ab98-4adb-b6bc-4ad302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:33.000Z",
|
|
"modified": "2017-04-07T10:33:33.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: ea6dffd2bb7c13eebdb605060b26ff2319f6f4ab81e9c41998351c039c177d5a",
|
|
"pattern": "[file:hashes.SHA1 = '20555c752f7ca4ded35dbf6220420b1f454a2d74']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76afe-2e7c-4dda-a643-4c2f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:34.000Z",
|
|
"modified": "2017-04-07T10:33:34.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: ea6dffd2bb7c13eebdb605060b26ff2319f6f4ab81e9c41998351c039c177d5a",
|
|
"pattern": "[file:hashes.MD5 = 'a42cc1ed872160ee51eaae83d6d3027c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76aff-9fec-4fe1-8e95-4c1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:35.000Z",
|
|
"modified": "2017-04-07T10:33:35.000Z",
|
|
"first_observed": "2017-04-07T10:33:35Z",
|
|
"last_observed": "2017-04-07T10:33:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76aff-9fec-4fe1-8e95-4c1d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76aff-9fec-4fe1-8e95-4c1d02de0b81",
|
|
"value": "https://www.virustotal.com/file/ea6dffd2bb7c13eebdb605060b26ff2319f6f4ab81e9c41998351c039c177d5a/analysis/1491513985/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b00-35a0-496f-b48a-499402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:36.000Z",
|
|
"modified": "2017-04-07T10:33:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e4f015b6cc0539fff746dc39229d25385d95e827204695b8b0003457cd206dab",
|
|
"pattern": "[file:hashes.SHA1 = '1ad45ab330ce5efe3cd3ecbb08477f2b02b93678']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b00-bfac-4835-a430-46cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:36.000Z",
|
|
"modified": "2017-04-07T10:33:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e4f015b6cc0539fff746dc39229d25385d95e827204695b8b0003457cd206dab",
|
|
"pattern": "[file:hashes.MD5 = '9277c5bc50aa7a32f4c3dabe7ebb0b23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b01-a440-4ffc-85b2-431902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:37.000Z",
|
|
"modified": "2017-04-07T10:33:37.000Z",
|
|
"first_observed": "2017-04-07T10:33:37Z",
|
|
"last_observed": "2017-04-07T10:33:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b01-a440-4ffc-85b2-431902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b01-a440-4ffc-85b2-431902de0b81",
|
|
"value": "https://www.virustotal.com/file/e4f015b6cc0539fff746dc39229d25385d95e827204695b8b0003457cd206dab/analysis/1462569483/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b02-3854-47e8-84c0-41e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:38.000Z",
|
|
"modified": "2017-04-07T10:33:38.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6279030f7e5eaeacd28232de35382c38614fefc90ef753f2492300c1150e54f0",
|
|
"pattern": "[file:hashes.SHA1 = '8a3f674f9bef55d88f4f86f2a35c092a844800b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b04-ccd4-4c61-a002-4b3d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:40.000Z",
|
|
"modified": "2017-04-07T10:33:40.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6279030f7e5eaeacd28232de35382c38614fefc90ef753f2492300c1150e54f0",
|
|
"pattern": "[file:hashes.MD5 = 'a44eac0c1a6e25c9d61dc33ef70b6978']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b05-0768-4d0b-85ad-477702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:41.000Z",
|
|
"modified": "2017-04-07T10:33:41.000Z",
|
|
"first_observed": "2017-04-07T10:33:41Z",
|
|
"last_observed": "2017-04-07T10:33:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b05-0768-4d0b-85ad-477702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b05-0768-4d0b-85ad-477702de0b81",
|
|
"value": "https://www.virustotal.com/file/6279030f7e5eaeacd28232de35382c38614fefc90ef753f2492300c1150e54f0/analysis/1464302050/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b06-26d8-45b0-9a9a-4f0e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:42.000Z",
|
|
"modified": "2017-04-07T10:33:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7e476fb1089b95bfb08ec3ab3931ae31da9fd1f742928bab339d297b70b9fcc2",
|
|
"pattern": "[file:hashes.SHA1 = '5a6cf5d1acf9f482ca1e9b1137abc79cf21f24e8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b06-9408-4621-8456-41e702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:42.000Z",
|
|
"modified": "2017-04-07T10:33:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7e476fb1089b95bfb08ec3ab3931ae31da9fd1f742928bab339d297b70b9fcc2",
|
|
"pattern": "[file:hashes.MD5 = 'f0dd2e20d2dbfeb9cf1bbd9dad0f3826']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b07-d1f0-435a-9bb9-413e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:43.000Z",
|
|
"modified": "2017-04-07T10:33:43.000Z",
|
|
"first_observed": "2017-04-07T10:33:43Z",
|
|
"last_observed": "2017-04-07T10:33:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b07-d1f0-435a-9bb9-413e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b07-d1f0-435a-9bb9-413e02de0b81",
|
|
"value": "https://www.virustotal.com/file/7e476fb1089b95bfb08ec3ab3931ae31da9fd1f742928bab339d297b70b9fcc2/analysis/1468559738/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b08-df60-4c64-80cc-4d8c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:44.000Z",
|
|
"modified": "2017-04-07T10:33:44.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5579cfef934b47519388719f0bf532bd4326d0221b6ab47c69ca098f3d2d2de3",
|
|
"pattern": "[file:hashes.SHA1 = 'ec0255d97a788e2950a83f18fe14dc968390f6c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b09-8ae0-4c54-8989-4bd102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:45.000Z",
|
|
"modified": "2017-04-07T10:33:45.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5579cfef934b47519388719f0bf532bd4326d0221b6ab47c69ca098f3d2d2de3",
|
|
"pattern": "[file:hashes.MD5 = 'd665bfe8632b1b3194eb68d09237c58f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b0a-1260-4fd8-a611-4d7202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:46.000Z",
|
|
"modified": "2017-04-07T10:33:46.000Z",
|
|
"first_observed": "2017-04-07T10:33:46Z",
|
|
"last_observed": "2017-04-07T10:33:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b0a-1260-4fd8-a611-4d7202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b0a-1260-4fd8-a611-4d7202de0b81",
|
|
"value": "https://www.virustotal.com/file/5579cfef934b47519388719f0bf532bd4326d0221b6ab47c69ca098f3d2d2de3/analysis/1468559485/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b0b-d69c-40a5-be61-408502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:47.000Z",
|
|
"modified": "2017-04-07T10:33:47.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 16e43f8d2e439b5ce8e48b75bb25e90011f1ccbb41278fe15f7982a304a832de",
|
|
"pattern": "[file:hashes.SHA1 = 'dbccee0b9814239355091e80fb138e58b3aec5fc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b0c-0b60-4742-bd6d-4bd702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:48.000Z",
|
|
"modified": "2017-04-07T10:33:48.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 16e43f8d2e439b5ce8e48b75bb25e90011f1ccbb41278fe15f7982a304a832de",
|
|
"pattern": "[file:hashes.MD5 = '02054e39bf975e50be493d40b257e1cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b0d-8f28-4444-a269-496f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:49.000Z",
|
|
"modified": "2017-04-07T10:33:49.000Z",
|
|
"first_observed": "2017-04-07T10:33:49Z",
|
|
"last_observed": "2017-04-07T10:33:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b0d-8f28-4444-a269-496f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b0d-8f28-4444-a269-496f02de0b81",
|
|
"value": "https://www.virustotal.com/file/16e43f8d2e439b5ce8e48b75bb25e90011f1ccbb41278fe15f7982a304a832de/analysis/1469034889/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b0e-f460-4429-99fa-44e102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:50.000Z",
|
|
"modified": "2017-04-07T10:33:50.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c721b5d3abc978ea8608f23b9a9a6ba81afe87d6d6660bc6006ee1ba83491d06",
|
|
"pattern": "[file:hashes.SHA1 = '97014f17719494c7cea2ac07db70ffa3d0c824f4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b0f-c190-4a8f-bba8-45be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:51.000Z",
|
|
"modified": "2017-04-07T10:33:51.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c721b5d3abc978ea8608f23b9a9a6ba81afe87d6d6660bc6006ee1ba83491d06",
|
|
"pattern": "[file:hashes.MD5 = 'f7b0dbc09c3fbef3e0a287e84ca8cebd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b10-411c-4942-8416-4a3202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:52.000Z",
|
|
"modified": "2017-04-07T10:33:52.000Z",
|
|
"first_observed": "2017-04-07T10:33:52Z",
|
|
"last_observed": "2017-04-07T10:33:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b10-411c-4942-8416-4a3202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b10-411c-4942-8416-4a3202de0b81",
|
|
"value": "https://www.virustotal.com/file/c721b5d3abc978ea8608f23b9a9a6ba81afe87d6d6660bc6006ee1ba83491d06/analysis/1491513984/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b11-aeb4-41ce-92ff-46ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:53.000Z",
|
|
"modified": "2017-04-07T10:33:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 50cb597f33f8252bd94c54927bd2e0259a732ad64fb8b413a205e1f290870445",
|
|
"pattern": "[file:hashes.SHA1 = 'a009459910dae8d43e46ea385cec17702b93bed6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b11-42b0-444b-8dbb-402502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:53.000Z",
|
|
"modified": "2017-04-07T10:33:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 50cb597f33f8252bd94c54927bd2e0259a732ad64fb8b413a205e1f290870445",
|
|
"pattern": "[file:hashes.MD5 = '20ba6461306aba555c2db3e86e4f959b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b12-d9dc-47a0-9f50-428402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:54.000Z",
|
|
"modified": "2017-04-07T10:33:54.000Z",
|
|
"first_observed": "2017-04-07T10:33:54Z",
|
|
"last_observed": "2017-04-07T10:33:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b12-d9dc-47a0-9f50-428402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b12-d9dc-47a0-9f50-428402de0b81",
|
|
"value": "https://www.virustotal.com/file/50cb597f33f8252bd94c54927bd2e0259a732ad64fb8b413a205e1f290870445/analysis/1491513984/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b13-d86c-4ed4-a63d-485702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:55.000Z",
|
|
"modified": "2017-04-07T10:33:55.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5a83a289c0c4c222bb190152bb8bc5f429e6799ac233ba99b7a860b8519872bc",
|
|
"pattern": "[file:hashes.SHA1 = '25f7e99a57f19b42fe22102f159ba3e0373e1e32']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b14-c6f4-4876-a9bd-47be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:56.000Z",
|
|
"modified": "2017-04-07T10:33:56.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5a83a289c0c4c222bb190152bb8bc5f429e6799ac233ba99b7a860b8519872bc",
|
|
"pattern": "[file:hashes.MD5 = '2fd3fda18ed858c5e51e424ebbad94c0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b15-6604-4bac-98c1-429b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:57.000Z",
|
|
"modified": "2017-04-07T10:33:57.000Z",
|
|
"first_observed": "2017-04-07T10:33:57Z",
|
|
"last_observed": "2017-04-07T10:33:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b15-6604-4bac-98c1-429b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b15-6604-4bac-98c1-429b02de0b81",
|
|
"value": "https://www.virustotal.com/file/5a83a289c0c4c222bb190152bb8bc5f429e6799ac233ba99b7a860b8519872bc/analysis/1491498863/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b16-0724-486c-9bfb-469f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:58.000Z",
|
|
"modified": "2017-04-07T10:33:58.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 722cfac01badf1106887fbc985060a2fb31eabf9943520bd24abf2fa208217b8",
|
|
"pattern": "[file:hashes.SHA1 = 'b00e0b5cd523977cc25a1e5c7fbc889f8f901353']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b17-8c64-4664-be49-446c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:59.000Z",
|
|
"modified": "2017-04-07T10:33:59.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 722cfac01badf1106887fbc985060a2fb31eabf9943520bd24abf2fa208217b8",
|
|
"pattern": "[file:hashes.MD5 = 'fe23fa6df4d8fb500859f0f76e92552d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:33:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b17-f398-4d26-bd48-4e5302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:33:59.000Z",
|
|
"modified": "2017-04-07T10:33:59.000Z",
|
|
"first_observed": "2017-04-07T10:33:59Z",
|
|
"last_observed": "2017-04-07T10:33:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b17-f398-4d26-bd48-4e5302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b17-f398-4d26-bd48-4e5302de0b81",
|
|
"value": "https://www.virustotal.com/file/722cfac01badf1106887fbc985060a2fb31eabf9943520bd24abf2fa208217b8/analysis/1491513984/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b18-0cc0-4712-9863-4eeb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:00.000Z",
|
|
"modified": "2017-04-07T10:34:00.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7d74e531dafdb6e645ac429c17aba3903e9c0f4fe7e4f93688d37eb638c52f48",
|
|
"pattern": "[file:hashes.SHA1 = 'f1d6da5f26d92ba28104316b78a6675c0bf024bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b19-f5f0-4ca2-8784-401a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:01.000Z",
|
|
"modified": "2017-04-07T10:34:01.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7d74e531dafdb6e645ac429c17aba3903e9c0f4fe7e4f93688d37eb638c52f48",
|
|
"pattern": "[file:hashes.MD5 = '07e47f06c5ed05a062e674f8d11b01d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b1a-31d4-418b-89f3-495302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:02.000Z",
|
|
"modified": "2017-04-07T10:34:02.000Z",
|
|
"first_observed": "2017-04-07T10:34:02Z",
|
|
"last_observed": "2017-04-07T10:34:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b1a-31d4-418b-89f3-495302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b1a-31d4-418b-89f3-495302de0b81",
|
|
"value": "https://www.virustotal.com/file/7d74e531dafdb6e645ac429c17aba3903e9c0f4fe7e4f93688d37eb638c52f48/analysis/1491498747/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b1b-19cc-422f-9e4f-4c7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:03.000Z",
|
|
"modified": "2017-04-07T10:34:03.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7b1a513520f18612c4cd2ac9e5e5a1d660274a77b8f190bd277339247b6a51ee",
|
|
"pattern": "[file:hashes.SHA1 = 'bb523dcedf8d0f4e04bf5f6ca36253fdf4e44b58']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b1c-1eb8-4e92-acde-444e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:04.000Z",
|
|
"modified": "2017-04-07T10:34:04.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 7b1a513520f18612c4cd2ac9e5e5a1d660274a77b8f190bd277339247b6a51ee",
|
|
"pattern": "[file:hashes.MD5 = '5731692c40e4836462280ece7bc0f7de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b1d-60cc-4688-be6b-457602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:05.000Z",
|
|
"modified": "2017-04-07T10:34:05.000Z",
|
|
"first_observed": "2017-04-07T10:34:05Z",
|
|
"last_observed": "2017-04-07T10:34:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b1d-60cc-4688-be6b-457602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b1d-60cc-4688-be6b-457602de0b81",
|
|
"value": "https://www.virustotal.com/file/7b1a513520f18612c4cd2ac9e5e5a1d660274a77b8f190bd277339247b6a51ee/analysis/1476007873/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b1d-337c-4a73-9fba-411502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:05.000Z",
|
|
"modified": "2017-04-07T10:34:05.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 244621fad10485386493efec3818196fc50f1a66e3048a62de456d64a2331720",
|
|
"pattern": "[file:hashes.SHA1 = 'd8091c375177303ab438a68ee1d4b1ee842580bd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b1e-45fc-4d37-96b7-4ae302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:06.000Z",
|
|
"modified": "2017-04-07T10:34:06.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 244621fad10485386493efec3818196fc50f1a66e3048a62de456d64a2331720",
|
|
"pattern": "[file:hashes.MD5 = '5c0e7ab56cdfb0a4dbf0f455e9233fed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b1f-08e8-4729-9273-4bc802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:07.000Z",
|
|
"modified": "2017-04-07T10:34:07.000Z",
|
|
"first_observed": "2017-04-07T10:34:07Z",
|
|
"last_observed": "2017-04-07T10:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b1f-08e8-4729-9273-4bc802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b1f-08e8-4729-9273-4bc802de0b81",
|
|
"value": "https://www.virustotal.com/file/244621fad10485386493efec3818196fc50f1a66e3048a62de456d64a2331720/analysis/1491513983/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b20-29d4-4296-b67d-479602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:08.000Z",
|
|
"modified": "2017-04-07T10:34:08.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2a71fcd81cf6c3bc6a43260b23cd7ef1c0694b0d85cdcdfdc8b25b139922a352",
|
|
"pattern": "[file:hashes.SHA1 = '7cda20d65ed3bff65c4bd7ce12561168b8bdbb1f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b21-dba8-4320-aa8d-4bbb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:09.000Z",
|
|
"modified": "2017-04-07T10:34:09.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2a71fcd81cf6c3bc6a43260b23cd7ef1c0694b0d85cdcdfdc8b25b139922a352",
|
|
"pattern": "[file:hashes.MD5 = 'bd75af219f417413a4e0fae8cd89febd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b22-8c1c-4b7b-b77b-4c8402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:10.000Z",
|
|
"modified": "2017-04-07T10:34:10.000Z",
|
|
"first_observed": "2017-04-07T10:34:10Z",
|
|
"last_observed": "2017-04-07T10:34:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b22-8c1c-4b7b-b77b-4c8402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b22-8c1c-4b7b-b77b-4c8402de0b81",
|
|
"value": "https://www.virustotal.com/file/2a71fcd81cf6c3bc6a43260b23cd7ef1c0694b0d85cdcdfdc8b25b139922a352/analysis/1475657585/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b23-0614-417f-a3e0-4acb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:11.000Z",
|
|
"modified": "2017-04-07T10:34:11.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 27b3a779d2e3d44cf0c4cc8e9f2862226fe329db7127b2272ba42011332832f3",
|
|
"pattern": "[file:hashes.SHA1 = '9ce3f5a3917f137de9443eb480f6554bffde79d5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b24-a5a4-4346-ab01-4cc502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:12.000Z",
|
|
"modified": "2017-04-07T10:34:12.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 27b3a779d2e3d44cf0c4cc8e9f2862226fe329db7127b2272ba42011332832f3",
|
|
"pattern": "[file:hashes.MD5 = '222880b8db346a91e05b72a31b8496f7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b24-22a8-49ac-9be4-482702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:12.000Z",
|
|
"modified": "2017-04-07T10:34:12.000Z",
|
|
"first_observed": "2017-04-07T10:34:12Z",
|
|
"last_observed": "2017-04-07T10:34:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b24-22a8-49ac-9be4-482702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b24-22a8-49ac-9be4-482702de0b81",
|
|
"value": "https://www.virustotal.com/file/27b3a779d2e3d44cf0c4cc8e9f2862226fe329db7127b2272ba42011332832f3/analysis/1475657607/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b25-e278-4628-b0a7-4e0502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:13.000Z",
|
|
"modified": "2017-04-07T10:34:13.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 64c5bfc0a1c76aaf9ed8b8f2a45d229afa9353a63fa7a2bba6d4a8c47980e70b",
|
|
"pattern": "[file:hashes.SHA1 = '8993b312fc7a988e6003ff4cc0e0e3cc8ae981d2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b26-c384-42e2-9f85-4c0302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:14.000Z",
|
|
"modified": "2017-04-07T10:34:14.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 64c5bfc0a1c76aaf9ed8b8f2a45d229afa9353a63fa7a2bba6d4a8c47980e70b",
|
|
"pattern": "[file:hashes.MD5 = '026271a0e5ade33fcc5d7944bda02004']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b27-219c-4e43-93ad-464802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:15.000Z",
|
|
"modified": "2017-04-07T10:34:15.000Z",
|
|
"first_observed": "2017-04-07T10:34:15Z",
|
|
"last_observed": "2017-04-07T10:34:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b27-219c-4e43-93ad-464802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b27-219c-4e43-93ad-464802de0b81",
|
|
"value": "https://www.virustotal.com/file/64c5bfc0a1c76aaf9ed8b8f2a45d229afa9353a63fa7a2bba6d4a8c47980e70b/analysis/1491513983/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b28-ed58-4022-9a9b-43e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:16.000Z",
|
|
"modified": "2017-04-07T10:34:16.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 618fc941c00005b02f62d9ebdb31363e4d51b2f927f3d0b36c238a333f080ad0",
|
|
"pattern": "[file:hashes.SHA1 = 'b120aa02a294e48d62ad202a57af4e29e446f4a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b29-75f4-4488-a665-433902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:17.000Z",
|
|
"modified": "2017-04-07T10:34:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 618fc941c00005b02f62d9ebdb31363e4d51b2f927f3d0b36c238a333f080ad0",
|
|
"pattern": "[file:hashes.MD5 = '15605e6e3faa6750acb4f04fd224e78b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b2a-25c0-424d-8958-45ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:18.000Z",
|
|
"modified": "2017-04-07T10:34:18.000Z",
|
|
"first_observed": "2017-04-07T10:34:18Z",
|
|
"last_observed": "2017-04-07T10:34:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b2a-25c0-424d-8958-45ed02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b2a-25c0-424d-8958-45ed02de0b81",
|
|
"value": "https://www.virustotal.com/file/618fc941c00005b02f62d9ebdb31363e4d51b2f927f3d0b36c238a333f080ad0/analysis/1475657754/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b2a-4664-4563-bec8-4fd502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:18.000Z",
|
|
"modified": "2017-04-07T10:34:18.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bacbcb52516bb1d54b82a8d128f460843827a9dff65024d4bedb88936fc40c97",
|
|
"pattern": "[file:hashes.SHA1 = '433a703d54de884fcd3509e3891adda55b48f6e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b2b-c6cc-4baf-9bb0-441602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:19.000Z",
|
|
"modified": "2017-04-07T10:34:19.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: bacbcb52516bb1d54b82a8d128f460843827a9dff65024d4bedb88936fc40c97",
|
|
"pattern": "[file:hashes.MD5 = '058769ba93223bede0ba601926693ddc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b2c-60e0-4763-a027-42b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:20.000Z",
|
|
"modified": "2017-04-07T10:34:20.000Z",
|
|
"first_observed": "2017-04-07T10:34:20Z",
|
|
"last_observed": "2017-04-07T10:34:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b2c-60e0-4763-a027-42b102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b2c-60e0-4763-a027-42b102de0b81",
|
|
"value": "https://www.virustotal.com/file/bacbcb52516bb1d54b82a8d128f460843827a9dff65024d4bedb88936fc40c97/analysis/1491498623/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b2d-1254-4349-aa2b-44c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:21.000Z",
|
|
"modified": "2017-04-07T10:34:21.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e926cf1e40c46f9578c76bb0df3a3ba7667853b63cc58b0f064f529b4365fbe0",
|
|
"pattern": "[file:hashes.SHA1 = '970304d3e169bf4b75757ad15542a628020f1eec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b2e-9118-44e3-86bd-447202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:22.000Z",
|
|
"modified": "2017-04-07T10:34:22.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e926cf1e40c46f9578c76bb0df3a3ba7667853b63cc58b0f064f529b4365fbe0",
|
|
"pattern": "[file:hashes.MD5 = '9f4023f2aefc8c4c261bfdd4bd911952']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b2f-a870-41f8-84b9-4b8f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:23.000Z",
|
|
"modified": "2017-04-07T10:34:23.000Z",
|
|
"first_observed": "2017-04-07T10:34:23Z",
|
|
"last_observed": "2017-04-07T10:34:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b2f-a870-41f8-84b9-4b8f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b2f-a870-41f8-84b9-4b8f02de0b81",
|
|
"value": "https://www.virustotal.com/file/e926cf1e40c46f9578c76bb0df3a3ba7667853b63cc58b0f064f529b4365fbe0/analysis/1491513981/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b30-e50c-4018-bc1c-424f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:24.000Z",
|
|
"modified": "2017-04-07T10:34:24.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: baf0fe69b670a6b96489cfb0bd80b03d8b454d5a3d2407d3c1570f1db9b58927",
|
|
"pattern": "[file:hashes.SHA1 = '9e29ddcd3a960077eb7a6334e579c0121a4edbef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b30-b9cc-4e67-a95e-4dd402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:24.000Z",
|
|
"modified": "2017-04-07T10:34:24.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: baf0fe69b670a6b96489cfb0bd80b03d8b454d5a3d2407d3c1570f1db9b58927",
|
|
"pattern": "[file:hashes.MD5 = 'e4d0049e5fef02c013b22fd9f5018272']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b31-21a8-4b3b-8289-40b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:25.000Z",
|
|
"modified": "2017-04-07T10:34:25.000Z",
|
|
"first_observed": "2017-04-07T10:34:25Z",
|
|
"last_observed": "2017-04-07T10:34:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b31-21a8-4b3b-8289-40b602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b31-21a8-4b3b-8289-40b602de0b81",
|
|
"value": "https://www.virustotal.com/file/baf0fe69b670a6b96489cfb0bd80b03d8b454d5a3d2407d3c1570f1db9b58927/analysis/1491513982/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b32-a1ac-42e9-9ef2-4bfb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:26.000Z",
|
|
"modified": "2017-04-07T10:34:26.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 3554b267dec35b5072ed5fce2510e70960e32195a0920811e83eb6207cc4bed0",
|
|
"pattern": "[file:hashes.SHA1 = '4e92c5f303f859f66a7acfbf75af10f4231fd3ba']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b33-c38c-40bf-bc05-4fa702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:27.000Z",
|
|
"modified": "2017-04-07T10:34:27.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 3554b267dec35b5072ed5fce2510e70960e32195a0920811e83eb6207cc4bed0",
|
|
"pattern": "[file:hashes.MD5 = '6a5c4d9a83135b745a8714f22f694c9a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b34-e1a0-45e1-a1d8-45ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:28.000Z",
|
|
"modified": "2017-04-07T10:34:28.000Z",
|
|
"first_observed": "2017-04-07T10:34:28Z",
|
|
"last_observed": "2017-04-07T10:34:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b34-e1a0-45e1-a1d8-45ff02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b34-e1a0-45e1-a1d8-45ff02de0b81",
|
|
"value": "https://www.virustotal.com/file/3554b267dec35b5072ed5fce2510e70960e32195a0920811e83eb6207cc4bed0/analysis/1491513981/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b35-7d58-4b7e-8152-4f8302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:29.000Z",
|
|
"modified": "2017-04-07T10:34:29.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: dff184a646f67fdf04fc7702e2a4ef60b4a165e56abb7e3a424f785ac8b02da9",
|
|
"pattern": "[file:hashes.SHA1 = '230e5261316b312199f39f5df6fb2187097f8810']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b36-0e54-42d1-b2c4-4c1802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:30.000Z",
|
|
"modified": "2017-04-07T10:34:30.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: dff184a646f67fdf04fc7702e2a4ef60b4a165e56abb7e3a424f785ac8b02da9",
|
|
"pattern": "[file:hashes.MD5 = '88afd6bbd9f35b3c1c49b667250b95f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b36-ca48-40e1-9c2f-4bac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:30.000Z",
|
|
"modified": "2017-04-07T10:34:30.000Z",
|
|
"first_observed": "2017-04-07T10:34:30Z",
|
|
"last_observed": "2017-04-07T10:34:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b36-ca48-40e1-9c2f-4bac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b36-ca48-40e1-9c2f-4bac02de0b81",
|
|
"value": "https://www.virustotal.com/file/dff184a646f67fdf04fc7702e2a4ef60b4a165e56abb7e3a424f785ac8b02da9/analysis/1475834551/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b37-aeb8-46c8-b827-477502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:31.000Z",
|
|
"modified": "2017-04-07T10:34:31.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 865bf72cd5f23350cba26bb185340ebc0def6b5bbd5d8c9c184e1d1e4d11c5b8",
|
|
"pattern": "[file:hashes.SHA1 = '7d58ce1aafce0a05b0322407b1e028512fff000b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b38-7f98-4ea5-bee1-4be802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:32.000Z",
|
|
"modified": "2017-04-07T10:34:32.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 865bf72cd5f23350cba26bb185340ebc0def6b5bbd5d8c9c184e1d1e4d11c5b8",
|
|
"pattern": "[file:hashes.MD5 = '19a234422f6f1c21906121ad5878e480']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b39-dfcc-4a2d-b741-4a5c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:33.000Z",
|
|
"modified": "2017-04-07T10:34:33.000Z",
|
|
"first_observed": "2017-04-07T10:34:33Z",
|
|
"last_observed": "2017-04-07T10:34:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b39-dfcc-4a2d-b741-4a5c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b39-dfcc-4a2d-b741-4a5c02de0b81",
|
|
"value": "https://www.virustotal.com/file/865bf72cd5f23350cba26bb185340ebc0def6b5bbd5d8c9c184e1d1e4d11c5b8/analysis/1491513981/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b3a-b914-44aa-96f4-418d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:34.000Z",
|
|
"modified": "2017-04-07T10:34:34.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f0cb1d8a58b389425f691522163a1cc3b2b6c4ca0004248c0f0daad7f4ffa12a",
|
|
"pattern": "[file:hashes.SHA1 = '579fe34d3eae724217c2e6a18cac9d05a5a46219']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b3b-9244-439d-9dee-456102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:35.000Z",
|
|
"modified": "2017-04-07T10:34:35.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f0cb1d8a58b389425f691522163a1cc3b2b6c4ca0004248c0f0daad7f4ffa12a",
|
|
"pattern": "[file:hashes.MD5 = 'f57f7736e4b4cb05d9bbb20660947d6d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b3c-596c-4342-a9e0-4ddc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:36.000Z",
|
|
"modified": "2017-04-07T10:34:36.000Z",
|
|
"first_observed": "2017-04-07T10:34:36Z",
|
|
"last_observed": "2017-04-07T10:34:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b3c-596c-4342-a9e0-4ddc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b3c-596c-4342-a9e0-4ddc02de0b81",
|
|
"value": "https://www.virustotal.com/file/f0cb1d8a58b389425f691522163a1cc3b2b6c4ca0004248c0f0daad7f4ffa12a/analysis/1481055472/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b3c-488c-48c8-9e1a-4a3702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:36.000Z",
|
|
"modified": "2017-04-07T10:34:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 78536b8ba75ba8269950099bb8205a11e94db9c28558293971e981c3a9e57b24",
|
|
"pattern": "[file:hashes.SHA1 = '77f29f8819cee58a1375c3923c5881a2b7b6b246']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b3d-a0dc-4f09-95bf-456002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:37.000Z",
|
|
"modified": "2017-04-07T10:34:37.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 78536b8ba75ba8269950099bb8205a11e94db9c28558293971e981c3a9e57b24",
|
|
"pattern": "[file:hashes.MD5 = 'ec3186de5be92eff578c20b7c572f7a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b3e-cd2c-4457-8800-487002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:38.000Z",
|
|
"modified": "2017-04-07T10:34:38.000Z",
|
|
"first_observed": "2017-04-07T10:34:38Z",
|
|
"last_observed": "2017-04-07T10:34:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b3e-cd2c-4457-8800-487002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b3e-cd2c-4457-8800-487002de0b81",
|
|
"value": "https://www.virustotal.com/file/78536b8ba75ba8269950099bb8205a11e94db9c28558293971e981c3a9e57b24/analysis/1491498488/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b3f-8a88-434a-9ca9-408302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:39.000Z",
|
|
"modified": "2017-04-07T10:34:39.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5e977ffbfc3d048c79640459ab33a932f1e17f77dae76d7a062c4cb0221b91f8",
|
|
"pattern": "[file:hashes.SHA1 = 'd4aca4d987b0c8000c96bcd211e8665eb2b5a8ae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b40-235c-460f-9c1e-429002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:40.000Z",
|
|
"modified": "2017-04-07T10:34:40.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 5e977ffbfc3d048c79640459ab33a932f1e17f77dae76d7a062c4cb0221b91f8",
|
|
"pattern": "[file:hashes.MD5 = '9075d79f9fec1df5689cca2218d406cd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b41-8ab8-49fa-8ccd-4f7102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:41.000Z",
|
|
"modified": "2017-04-07T10:34:41.000Z",
|
|
"first_observed": "2017-04-07T10:34:41Z",
|
|
"last_observed": "2017-04-07T10:34:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b41-8ab8-49fa-8ccd-4f7102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b41-8ab8-49fa-8ccd-4f7102de0b81",
|
|
"value": "https://www.virustotal.com/file/5e977ffbfc3d048c79640459ab33a932f1e17f77dae76d7a062c4cb0221b91f8/analysis/1477761377/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b42-4d6c-4402-bb5b-417d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:42.000Z",
|
|
"modified": "2017-04-07T10:34:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2dae0b95ba31c12c59d577b32c11ed3d1dff6db76f9c92064a2bc2764eb8611f",
|
|
"pattern": "[file:hashes.SHA1 = '2956ada09e94fb6fd6f94733bab9aab81ef2a980']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b42-e4a8-4cd0-8b56-4d0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:42.000Z",
|
|
"modified": "2017-04-07T10:34:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2dae0b95ba31c12c59d577b32c11ed3d1dff6db76f9c92064a2bc2764eb8611f",
|
|
"pattern": "[file:hashes.MD5 = '0e069bd6cb62731473822334a2c15353']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b43-e610-4e03-a8b0-46c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:43.000Z",
|
|
"modified": "2017-04-07T10:34:43.000Z",
|
|
"first_observed": "2017-04-07T10:34:43Z",
|
|
"last_observed": "2017-04-07T10:34:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b43-e610-4e03-a8b0-46c802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b43-e610-4e03-a8b0-46c802de0b81",
|
|
"value": "https://www.virustotal.com/file/2dae0b95ba31c12c59d577b32c11ed3d1dff6db76f9c92064a2bc2764eb8611f/analysis/1491513980/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b44-21e8-41c8-b0b7-4ef402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:44.000Z",
|
|
"modified": "2017-04-07T10:34:44.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e58267f9ff31408d0bb1b84948e1fd3c02231cfd0628797cc2a6045354e0b065",
|
|
"pattern": "[file:hashes.SHA1 = '93456a615bfcb656d20364b4e3b19818e8b1adfb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b45-a818-46a1-94bb-493902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:45.000Z",
|
|
"modified": "2017-04-07T10:34:45.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e58267f9ff31408d0bb1b84948e1fd3c02231cfd0628797cc2a6045354e0b065",
|
|
"pattern": "[file:hashes.MD5 = 'ee8e6929c64c32bd1a86ea8c50802a09']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b46-7f58-49b3-8f7b-458c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:46.000Z",
|
|
"modified": "2017-04-07T10:34:46.000Z",
|
|
"first_observed": "2017-04-07T10:34:46Z",
|
|
"last_observed": "2017-04-07T10:34:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b46-7f58-49b3-8f7b-458c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b46-7f58-49b3-8f7b-458c02de0b81",
|
|
"value": "https://www.virustotal.com/file/e58267f9ff31408d0bb1b84948e1fd3c02231cfd0628797cc2a6045354e0b065/analysis/1491513980/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b47-e44c-4569-8cf1-468302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:47.000Z",
|
|
"modified": "2017-04-07T10:34:47.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1a609b82e95501f56f0f47014c4224fdba457b27c58672292231c3adfcfdd7eb",
|
|
"pattern": "[file:hashes.SHA1 = '9d521159aba615557ef53154d7f69231c64d04f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b48-fa78-4692-8663-4df502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:48.000Z",
|
|
"modified": "2017-04-07T10:34:48.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1a609b82e95501f56f0f47014c4224fdba457b27c58672292231c3adfcfdd7eb",
|
|
"pattern": "[file:hashes.MD5 = '775c128456a53dec85305a1e78ed5edf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b48-ec3c-4773-accf-44e002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:48.000Z",
|
|
"modified": "2017-04-07T10:34:48.000Z",
|
|
"first_observed": "2017-04-07T10:34:48Z",
|
|
"last_observed": "2017-04-07T10:34:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b48-ec3c-4773-accf-44e002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b48-ec3c-4773-accf-44e002de0b81",
|
|
"value": "https://www.virustotal.com/file/1a609b82e95501f56f0f47014c4224fdba457b27c58672292231c3adfcfdd7eb/analysis/1485853425/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b49-7c4c-4b6c-aab7-422602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:49.000Z",
|
|
"modified": "2017-04-07T10:34:49.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4d54b94d081fa2d0c0626805f71bca86314201a6215fbd910c98024b372158c2",
|
|
"pattern": "[file:hashes.SHA1 = '73707453632214812ceaf78363210bcd9b72da8f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b4a-7b70-49cd-9e4e-4cd602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:50.000Z",
|
|
"modified": "2017-04-07T10:34:50.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4d54b94d081fa2d0c0626805f71bca86314201a6215fbd910c98024b372158c2",
|
|
"pattern": "[file:hashes.MD5 = '41799f40626f26d8337a7724ef3d1938']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b4b-6db8-4709-b787-4c8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:51.000Z",
|
|
"modified": "2017-04-07T10:34:51.000Z",
|
|
"first_observed": "2017-04-07T10:34:51Z",
|
|
"last_observed": "2017-04-07T10:34:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b4b-6db8-4709-b787-4c8e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b4b-6db8-4709-b787-4c8e02de0b81",
|
|
"value": "https://www.virustotal.com/file/4d54b94d081fa2d0c0626805f71bca86314201a6215fbd910c98024b372158c2/analysis/1478606137/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b4c-3c78-42c9-823b-4cb002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:52.000Z",
|
|
"modified": "2017-04-07T10:34:52.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a8635544eab476c6128793b00bf1bd48ce9d41692585aab1690f2a44837efaac",
|
|
"pattern": "[file:hashes.SHA1 = '7b757261949586b2e6d570d6a8d130649ed9f0a1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b4d-8d08-48e2-8971-47f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:53.000Z",
|
|
"modified": "2017-04-07T10:34:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a8635544eab476c6128793b00bf1bd48ce9d41692585aab1690f2a44837efaac",
|
|
"pattern": "[file:hashes.MD5 = '721ae60bbc28c8992f1476b393ee5210']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b4e-40c8-4afd-aba5-4bfb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:54.000Z",
|
|
"modified": "2017-04-07T10:34:54.000Z",
|
|
"first_observed": "2017-04-07T10:34:54Z",
|
|
"last_observed": "2017-04-07T10:34:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b4e-40c8-4afd-aba5-4bfb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b4e-40c8-4afd-aba5-4bfb02de0b81",
|
|
"value": "https://www.virustotal.com/file/a8635544eab476c6128793b00bf1bd48ce9d41692585aab1690f2a44837efaac/analysis/1491498447/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b4e-aaac-42e2-9383-4ecd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:54.000Z",
|
|
"modified": "2017-04-07T10:34:54.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 365be95490051c077b2bea93eb8e647cc4ab76cc51ebc6781abfca8b6d55b551",
|
|
"pattern": "[file:hashes.SHA1 = '057345e5e4f484fa1a739e80d964f8ce33faab27']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b4f-b050-4f18-9faa-490f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:55.000Z",
|
|
"modified": "2017-04-07T10:34:55.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 365be95490051c077b2bea93eb8e647cc4ab76cc51ebc6781abfca8b6d55b551",
|
|
"pattern": "[file:hashes.MD5 = '19aa2acda92b14c79acb181ca7796bd0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b50-acf8-419d-8f37-4b5402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:56.000Z",
|
|
"modified": "2017-04-07T10:34:56.000Z",
|
|
"first_observed": "2017-04-07T10:34:56Z",
|
|
"last_observed": "2017-04-07T10:34:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b50-acf8-419d-8f37-4b5402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b50-acf8-419d-8f37-4b5402de0b81",
|
|
"value": "https://www.virustotal.com/file/365be95490051c077b2bea93eb8e647cc4ab76cc51ebc6781abfca8b6d55b551/analysis/1491513979/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b51-76a0-4131-9ee6-441602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:57.000Z",
|
|
"modified": "2017-04-07T10:34:57.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 42c12d9b35abbb79212bf9d35d7c391d18e2635e558eb6ab8472510df79da09f",
|
|
"pattern": "[file:hashes.SHA1 = '82ff0344c650f7c63d9edd257bd823d13a5b23f7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b52-32b0-412e-b9d9-49be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:58.000Z",
|
|
"modified": "2017-04-07T10:34:58.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 42c12d9b35abbb79212bf9d35d7c391d18e2635e558eb6ab8472510df79da09f",
|
|
"pattern": "[file:hashes.MD5 = 'ae67b0b632230a887bef7a112432aa0d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:34:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b53-e670-4012-b5ba-45c002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:34:59.000Z",
|
|
"modified": "2017-04-07T10:34:59.000Z",
|
|
"first_observed": "2017-04-07T10:34:59Z",
|
|
"last_observed": "2017-04-07T10:34:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b53-e670-4012-b5ba-45c002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b53-e670-4012-b5ba-45c002de0b81",
|
|
"value": "https://www.virustotal.com/file/42c12d9b35abbb79212bf9d35d7c391d18e2635e558eb6ab8472510df79da09f/analysis/1480053272/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b54-3944-47ca-be56-470702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:00.000Z",
|
|
"modified": "2017-04-07T10:35:00.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 83d07d027709c724b146aaf44ff63d969b9c2824bb5f0b3c1be5af4f18b3cd97",
|
|
"pattern": "[file:hashes.SHA1 = '64b1374afd288fd624be4aba3937388e4a873215']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b55-c378-4931-be8c-47f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:01.000Z",
|
|
"modified": "2017-04-07T10:35:01.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 83d07d027709c724b146aaf44ff63d969b9c2824bb5f0b3c1be5af4f18b3cd97",
|
|
"pattern": "[file:hashes.MD5 = 'ce066f4dbba840e8bc16cd7793b1dd0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b55-138c-4401-abd2-4b3d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:01.000Z",
|
|
"modified": "2017-04-07T10:35:01.000Z",
|
|
"first_observed": "2017-04-07T10:35:01Z",
|
|
"last_observed": "2017-04-07T10:35:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b55-138c-4401-abd2-4b3d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b55-138c-4401-abd2-4b3d02de0b81",
|
|
"value": "https://www.virustotal.com/file/83d07d027709c724b146aaf44ff63d969b9c2824bb5f0b3c1be5af4f18b3cd97/analysis/1491513978/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b56-fafc-47f0-ba96-4c3e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:02.000Z",
|
|
"modified": "2017-04-07T10:35:02.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 967fd8f1e08cde8dbc960f3d9fcac5a86b77003cae88d59be78ce0a7e6ad0d88",
|
|
"pattern": "[file:hashes.SHA1 = '8ec964ed66afffb09ab374317f7d5ce1ad63ffef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b57-faa4-44f2-8285-40eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:03.000Z",
|
|
"modified": "2017-04-07T10:35:03.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 967fd8f1e08cde8dbc960f3d9fcac5a86b77003cae88d59be78ce0a7e6ad0d88",
|
|
"pattern": "[file:hashes.MD5 = '9c4026002ab1615aaeab941c2f900386']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b58-9fd4-4687-b43b-485402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:04.000Z",
|
|
"modified": "2017-04-07T10:35:04.000Z",
|
|
"first_observed": "2017-04-07T10:35:04Z",
|
|
"last_observed": "2017-04-07T10:35:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b58-9fd4-4687-b43b-485402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b58-9fd4-4687-b43b-485402de0b81",
|
|
"value": "https://www.virustotal.com/file/967fd8f1e08cde8dbc960f3d9fcac5a86b77003cae88d59be78ce0a7e6ad0d88/analysis/1491513979/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b59-051c-4cc8-85b9-498202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:05.000Z",
|
|
"modified": "2017-04-07T10:35:05.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 34a4a989a6d83eea916c455a9c304823786f11d39c7525583f75a0fd35906a1e",
|
|
"pattern": "[file:hashes.SHA1 = '8a4188236704fb7546b57a5beea2856be83be874']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b5a-2390-40d9-b9bb-47e902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:06.000Z",
|
|
"modified": "2017-04-07T10:35:06.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 34a4a989a6d83eea916c455a9c304823786f11d39c7525583f75a0fd35906a1e",
|
|
"pattern": "[file:hashes.MD5 = '1507ebfa9c6fe407c8b8fd44c1019b12']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b5b-7384-4a7f-b286-478102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:07.000Z",
|
|
"modified": "2017-04-07T10:35:07.000Z",
|
|
"first_observed": "2017-04-07T10:35:07Z",
|
|
"last_observed": "2017-04-07T10:35:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b5b-7384-4a7f-b286-478102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b5b-7384-4a7f-b286-478102de0b81",
|
|
"value": "https://www.virustotal.com/file/34a4a989a6d83eea916c455a9c304823786f11d39c7525583f75a0fd35906a1e/analysis/1481251906/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b5c-dcc0-4e01-9e34-4b0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:08.000Z",
|
|
"modified": "2017-04-07T10:35:08.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 00b9fe607cb0b6ba45cd7ffbc3d710264c6109fdbad992933f68bbfc15785a18",
|
|
"pattern": "[file:hashes.SHA1 = 'f8887f44146acf7352d00c1e14423f00c6447271']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b5d-4698-48e5-a700-4a5202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:09.000Z",
|
|
"modified": "2017-04-07T10:35:09.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 00b9fe607cb0b6ba45cd7ffbc3d710264c6109fdbad992933f68bbfc15785a18",
|
|
"pattern": "[file:hashes.MD5 = 'ed8589ef50d6552011f0e867f17b0dac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b5e-acdc-46b2-85cf-40f102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:10.000Z",
|
|
"modified": "2017-04-07T10:35:10.000Z",
|
|
"first_observed": "2017-04-07T10:35:10Z",
|
|
"last_observed": "2017-04-07T10:35:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b5e-acdc-46b2-85cf-40f102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b5e-acdc-46b2-85cf-40f102de0b81",
|
|
"value": "https://www.virustotal.com/file/00b9fe607cb0b6ba45cd7ffbc3d710264c6109fdbad992933f68bbfc15785a18/analysis/1484928554/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b5f-d334-49ba-975f-4c6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:11.000Z",
|
|
"modified": "2017-04-07T10:35:11.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b119b2530baf4c80a5543b7c6bacb615357b2deff27d9b6a638f799617ec1641",
|
|
"pattern": "[file:hashes.SHA1 = 'ccd2f1488ca3ddbabf0ce8348f44c7578496e6c1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b5f-93f4-45ae-b413-413502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:11.000Z",
|
|
"modified": "2017-04-07T10:35:11.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b119b2530baf4c80a5543b7c6bacb615357b2deff27d9b6a638f799617ec1641",
|
|
"pattern": "[file:hashes.MD5 = 'e82ddb04d2f6b7d1327c9c7f7edf3086']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b60-d1f0-4829-ba67-4c8702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:12.000Z",
|
|
"modified": "2017-04-07T10:35:12.000Z",
|
|
"first_observed": "2017-04-07T10:35:12Z",
|
|
"last_observed": "2017-04-07T10:35:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b60-d1f0-4829-ba67-4c8702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b60-d1f0-4829-ba67-4c8702de0b81",
|
|
"value": "https://www.virustotal.com/file/b119b2530baf4c80a5543b7c6bacb615357b2deff27d9b6a638f799617ec1641/analysis/1491513977/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b61-4f5c-4787-ab65-4e0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:13.000Z",
|
|
"modified": "2017-04-07T10:35:13.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 787f581acd27f8c8b449b3bc0ca214a1b3421197ff789333ef1b44a5de850c03",
|
|
"pattern": "[file:hashes.SHA1 = '85b0f27ed6e716c8ba1dadb0887df8cd86d372db']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b62-f044-41c4-ab93-4d0c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:14.000Z",
|
|
"modified": "2017-04-07T10:35:14.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 787f581acd27f8c8b449b3bc0ca214a1b3421197ff789333ef1b44a5de850c03",
|
|
"pattern": "[file:hashes.MD5 = '7103143145440360cca5c9da7a19eaf7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b63-d538-41e8-b2fd-4c9802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:15.000Z",
|
|
"modified": "2017-04-07T10:35:15.000Z",
|
|
"first_observed": "2017-04-07T10:35:15Z",
|
|
"last_observed": "2017-04-07T10:35:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b63-d538-41e8-b2fd-4c9802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b63-d538-41e8-b2fd-4c9802de0b81",
|
|
"value": "https://www.virustotal.com/file/787f581acd27f8c8b449b3bc0ca214a1b3421197ff789333ef1b44a5de850c03/analysis/1491513976/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b64-e378-46ad-96d1-4f4e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:16.000Z",
|
|
"modified": "2017-04-07T10:35:16.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e771f7512bd1efc86884fad12115f2fb5abc97eef78ca7dce1fbc9fb6f23360d",
|
|
"pattern": "[file:hashes.SHA1 = '80866816e845e25317f73b0be9da758fb8f93d5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b65-7d90-4d06-b15a-445902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:17.000Z",
|
|
"modified": "2017-04-07T10:35:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e771f7512bd1efc86884fad12115f2fb5abc97eef78ca7dce1fbc9fb6f23360d",
|
|
"pattern": "[file:hashes.MD5 = 'bd5c3997307fd02175f1ec797596160c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b66-4c68-4778-b6f0-49d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:18.000Z",
|
|
"modified": "2017-04-07T10:35:18.000Z",
|
|
"first_observed": "2017-04-07T10:35:18Z",
|
|
"last_observed": "2017-04-07T10:35:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b66-4c68-4778-b6f0-49d702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b66-4c68-4778-b6f0-49d702de0b81",
|
|
"value": "https://www.virustotal.com/file/e771f7512bd1efc86884fad12115f2fb5abc97eef78ca7dce1fbc9fb6f23360d/analysis/1491513977/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b67-db38-4d44-bf96-47bd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:19.000Z",
|
|
"modified": "2017-04-07T10:35:19.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 646b6591002c125108fa1e108aa9be84f4c83f3130836279745e372ee12867cf",
|
|
"pattern": "[file:hashes.SHA1 = 'f01d4cf34d860cf8e99ed1ef3cc5381158c0ce7c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b68-adbc-4681-a913-415d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:20.000Z",
|
|
"modified": "2017-04-07T10:35:20.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 646b6591002c125108fa1e108aa9be84f4c83f3130836279745e372ee12867cf",
|
|
"pattern": "[file:hashes.MD5 = '7dd560d8cee99f4126b50dca52854a5e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b69-0c70-4a26-9e73-4f4602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:21.000Z",
|
|
"modified": "2017-04-07T10:35:21.000Z",
|
|
"first_observed": "2017-04-07T10:35:21Z",
|
|
"last_observed": "2017-04-07T10:35:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b69-0c70-4a26-9e73-4f4602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b69-0c70-4a26-9e73-4f4602de0b81",
|
|
"value": "https://www.virustotal.com/file/646b6591002c125108fa1e108aa9be84f4c83f3130836279745e372ee12867cf/analysis/1491513977/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b69-7dec-4a1f-b9fa-445e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:21.000Z",
|
|
"modified": "2017-04-07T10:35:21.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 11cbd7a2ce58191e4dbd3efffba97c5c4c0edd437511e2ecbd42811dac1cfa3d",
|
|
"pattern": "[file:hashes.SHA1 = 'c81391b8ca99106c4739579b288b9f5abfacde76']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b6a-c834-417c-a0af-453002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:22.000Z",
|
|
"modified": "2017-04-07T10:35:22.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 11cbd7a2ce58191e4dbd3efffba97c5c4c0edd437511e2ecbd42811dac1cfa3d",
|
|
"pattern": "[file:hashes.MD5 = '09e4e6fa85b802c46bc121fcaecc5666']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b6b-2ac0-45fa-8282-4ce002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:23.000Z",
|
|
"modified": "2017-04-07T10:35:23.000Z",
|
|
"first_observed": "2017-04-07T10:35:23Z",
|
|
"last_observed": "2017-04-07T10:35:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b6b-2ac0-45fa-8282-4ce002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b6b-2ac0-45fa-8282-4ce002de0b81",
|
|
"value": "https://www.virustotal.com/file/11cbd7a2ce58191e4dbd3efffba97c5c4c0edd437511e2ecbd42811dac1cfa3d/analysis/1486445153/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b6c-68a4-4dfa-80a1-4e7102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:24.000Z",
|
|
"modified": "2017-04-07T10:35:24.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f296539deddb1b661868c69cde1783a2a2be15456ea3e31523652b5f10cc7d36",
|
|
"pattern": "[file:hashes.SHA1 = '252bf29b102cc7cd27464121f27bff307180cb82']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b6d-6654-46c9-8df9-498f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:25.000Z",
|
|
"modified": "2017-04-07T10:35:25.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: f296539deddb1b661868c69cde1783a2a2be15456ea3e31523652b5f10cc7d36",
|
|
"pattern": "[file:hashes.MD5 = 'c2cb6380a492ee8ded3a694229383505']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b6e-0aa8-4147-bcaf-4c2002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:26.000Z",
|
|
"modified": "2017-04-07T10:35:26.000Z",
|
|
"first_observed": "2017-04-07T10:35:26Z",
|
|
"last_observed": "2017-04-07T10:35:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b6e-0aa8-4147-bcaf-4c2002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b6e-0aa8-4147-bcaf-4c2002de0b81",
|
|
"value": "https://www.virustotal.com/file/f296539deddb1b661868c69cde1783a2a2be15456ea3e31523652b5f10cc7d36/analysis/1491498359/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b6f-49b4-4d72-aa94-41db02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:27.000Z",
|
|
"modified": "2017-04-07T10:35:27.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: fa80f9b2163d7db3e026316967d241818c9e57c1376830899352115bc08d51ac",
|
|
"pattern": "[file:hashes.SHA1 = '6b2958dae43f895620deebbab782a066f29926e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b70-e8c0-4350-9181-4f5102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:28.000Z",
|
|
"modified": "2017-04-07T10:35:28.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: fa80f9b2163d7db3e026316967d241818c9e57c1376830899352115bc08d51ac",
|
|
"pattern": "[file:hashes.MD5 = '4eeb610eb430fbdc6eefb0932dcb5475']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b71-34d8-43ff-84cc-4ba602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:29.000Z",
|
|
"modified": "2017-04-07T10:35:29.000Z",
|
|
"first_observed": "2017-04-07T10:35:29Z",
|
|
"last_observed": "2017-04-07T10:35:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b71-34d8-43ff-84cc-4ba602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b71-34d8-43ff-84cc-4ba602de0b81",
|
|
"value": "https://www.virustotal.com/file/fa80f9b2163d7db3e026316967d241818c9e57c1376830899352115bc08d51ac/analysis/1491474602/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b72-fe60-46fa-8b09-428202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:30.000Z",
|
|
"modified": "2017-04-07T10:35:30.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2321fbde63ceb3d0086a9bbce55940cc6f05919acf49fdb731f75447863c795c",
|
|
"pattern": "[file:hashes.SHA1 = '43ddce54c463ee1a2b94fd2a105620ff350b7fe5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b73-4aa8-4b86-b47c-4a6b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:31.000Z",
|
|
"modified": "2017-04-07T10:35:31.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2321fbde63ceb3d0086a9bbce55940cc6f05919acf49fdb731f75447863c795c",
|
|
"pattern": "[file:hashes.MD5 = '1381c805f00552ad0e467acee867b29e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b74-87ec-44bb-a8f8-403902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:32.000Z",
|
|
"modified": "2017-04-07T10:35:32.000Z",
|
|
"first_observed": "2017-04-07T10:35:32Z",
|
|
"last_observed": "2017-04-07T10:35:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b74-87ec-44bb-a8f8-403902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b74-87ec-44bb-a8f8-403902de0b81",
|
|
"value": "https://www.virustotal.com/file/2321fbde63ceb3d0086a9bbce55940cc6f05919acf49fdb731f75447863c795c/analysis/1491513976/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b74-4964-4b46-ac95-4b4002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:32.000Z",
|
|
"modified": "2017-04-07T10:35:32.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: df2f111c952ac720cb9e33afb24a1c9d0c9ecaeaea4c079f48fadc1a4ed333d5",
|
|
"pattern": "[file:hashes.SHA1 = 'bac351bb8fb91ddfdbac9640896bd40dba9cff35']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b75-bf00-46e6-879d-499602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:33.000Z",
|
|
"modified": "2017-04-07T10:35:33.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: df2f111c952ac720cb9e33afb24a1c9d0c9ecaeaea4c079f48fadc1a4ed333d5",
|
|
"pattern": "[file:hashes.MD5 = 'ad44d53c15fdb39e1460cae6423d1a23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b76-671c-4817-bfaa-4a5102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:34.000Z",
|
|
"modified": "2017-04-07T10:35:34.000Z",
|
|
"first_observed": "2017-04-07T10:35:34Z",
|
|
"last_observed": "2017-04-07T10:35:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b76-671c-4817-bfaa-4a5102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b76-671c-4817-bfaa-4a5102de0b81",
|
|
"value": "https://www.virustotal.com/file/df2f111c952ac720cb9e33afb24a1c9d0c9ecaeaea4c079f48fadc1a4ed333d5/analysis/1483892286/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b77-02dc-4064-a8a1-444602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:35.000Z",
|
|
"modified": "2017-04-07T10:35:35.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4ae00d8000510629bbffc55652401ee4124109c55500075049f9440fe86391cb",
|
|
"pattern": "[file:hashes.SHA1 = 'b661f4e1484da332ef84a4690276dd5030f7848e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b78-4f1c-4f9d-a3af-420002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:36.000Z",
|
|
"modified": "2017-04-07T10:35:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4ae00d8000510629bbffc55652401ee4124109c55500075049f9440fe86391cb",
|
|
"pattern": "[file:hashes.MD5 = 'b5792f6671ba5b407a455766ed80fb22']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b79-7664-41ca-90a0-46a502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:37.000Z",
|
|
"modified": "2017-04-07T10:35:37.000Z",
|
|
"first_observed": "2017-04-07T10:35:37Z",
|
|
"last_observed": "2017-04-07T10:35:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b79-7664-41ca-90a0-46a502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b79-7664-41ca-90a0-46a502de0b81",
|
|
"value": "https://www.virustotal.com/file/4ae00d8000510629bbffc55652401ee4124109c55500075049f9440fe86391cb/analysis/1491513975/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b7a-9ec4-4b7b-8e96-4f2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:38.000Z",
|
|
"modified": "2017-04-07T10:35:38.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 71aa4f9bc78fd5d457e4a2f2914516fc0081d2d5d22da26e1c70f86d9bd6bab1",
|
|
"pattern": "[file:hashes.SHA1 = '1345ab660fade324cea4780687d2254e56ac31ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b7b-f614-48ae-abe2-466e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:39.000Z",
|
|
"modified": "2017-04-07T10:35:39.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 71aa4f9bc78fd5d457e4a2f2914516fc0081d2d5d22da26e1c70f86d9bd6bab1",
|
|
"pattern": "[file:hashes.MD5 = 'c0dc81e3a45709ccd07984d9248a9c1c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b7c-4af4-4d0f-a92f-491702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:40.000Z",
|
|
"modified": "2017-04-07T10:35:40.000Z",
|
|
"first_observed": "2017-04-07T10:35:40Z",
|
|
"last_observed": "2017-04-07T10:35:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b7c-4af4-4d0f-a92f-491702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b7c-4af4-4d0f-a92f-491702de0b81",
|
|
"value": "https://www.virustotal.com/file/71aa4f9bc78fd5d457e4a2f2914516fc0081d2d5d22da26e1c70f86d9bd6bab1/analysis/1482728004/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b7d-74f8-4845-a7d2-48ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:41.000Z",
|
|
"modified": "2017-04-07T10:35:41.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c7d2a0803f9d4f9f37d5a0f3a37b97eaa672d4b3c700163847736cb9f91aabad",
|
|
"pattern": "[file:hashes.SHA1 = 'a93845078e527c7bb3400fcb9c153c7c9144da99']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b7e-80b8-4ebb-95cc-463d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:42.000Z",
|
|
"modified": "2017-04-07T10:35:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: c7d2a0803f9d4f9f37d5a0f3a37b97eaa672d4b3c700163847736cb9f91aabad",
|
|
"pattern": "[file:hashes.MD5 = '0c97e922b62d2497e37c5c01a807f2ae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b7f-0e54-4729-bd59-43b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:43.000Z",
|
|
"modified": "2017-04-07T10:35:43.000Z",
|
|
"first_observed": "2017-04-07T10:35:43Z",
|
|
"last_observed": "2017-04-07T10:35:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b7f-0e54-4729-bd59-43b802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b7f-0e54-4729-bd59-43b802de0b81",
|
|
"value": "https://www.virustotal.com/file/c7d2a0803f9d4f9f37d5a0f3a37b97eaa672d4b3c700163847736cb9f91aabad/analysis/1491513974/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b80-1fa0-4dfc-a970-40a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:44.000Z",
|
|
"modified": "2017-04-07T10:35:44.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 400c9fa4012a67e88b986d206deb8b10acff3091b6e7c98f0f98ac553ebd021b",
|
|
"pattern": "[file:hashes.SHA1 = '3481eedd989d3275d55f22757bc614f7ddb041ea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b81-7280-4096-8451-4ab202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:45.000Z",
|
|
"modified": "2017-04-07T10:35:45.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 400c9fa4012a67e88b986d206deb8b10acff3091b6e7c98f0f98ac553ebd021b",
|
|
"pattern": "[file:hashes.MD5 = 'e6da1e8bf6b6ffc52c56788500e98eb6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b81-43b4-4f1c-a77d-460202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:45.000Z",
|
|
"modified": "2017-04-07T10:35:45.000Z",
|
|
"first_observed": "2017-04-07T10:35:45Z",
|
|
"last_observed": "2017-04-07T10:35:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b81-43b4-4f1c-a77d-460202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b81-43b4-4f1c-a77d-460202de0b81",
|
|
"value": "https://www.virustotal.com/file/400c9fa4012a67e88b986d206deb8b10acff3091b6e7c98f0f98ac553ebd021b/analysis/1491513975/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b82-d968-42a3-ba91-435502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:46.000Z",
|
|
"modified": "2017-04-07T10:35:46.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4eca7eedcb5cfa0f02306774b9ed685a5ffc738669bb90cb5d57dad87a46833b",
|
|
"pattern": "[file:hashes.SHA1 = 'e34ec970accba940c573a2897a73baa7a276e2d0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b83-0a94-402b-9f1a-44e702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:47.000Z",
|
|
"modified": "2017-04-07T10:35:47.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4eca7eedcb5cfa0f02306774b9ed685a5ffc738669bb90cb5d57dad87a46833b",
|
|
"pattern": "[file:hashes.MD5 = '220dd77f7bbbd7ca5fef105e6ab8e35e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b84-7458-4e74-b2f2-4dd402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:48.000Z",
|
|
"modified": "2017-04-07T10:35:48.000Z",
|
|
"first_observed": "2017-04-07T10:35:48Z",
|
|
"last_observed": "2017-04-07T10:35:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b84-7458-4e74-b2f2-4dd402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b84-7458-4e74-b2f2-4dd402de0b81",
|
|
"value": "https://www.virustotal.com/file/4eca7eedcb5cfa0f02306774b9ed685a5ffc738669bb90cb5d57dad87a46833b/analysis/1491513974/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b85-8160-4f80-96e2-405802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:49.000Z",
|
|
"modified": "2017-04-07T10:35:49.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: ae5625a0fe39b34884cfd33832181392e9cf5157b8070b2e1b3d04c87fb46eec",
|
|
"pattern": "[file:hashes.SHA1 = 'f4a44d769a59718c2734bc769b45fb936ed89619']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b86-0a44-46cd-9280-465102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:50.000Z",
|
|
"modified": "2017-04-07T10:35:50.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: ae5625a0fe39b34884cfd33832181392e9cf5157b8070b2e1b3d04c87fb46eec",
|
|
"pattern": "[file:hashes.MD5 = '06410f97ec2a6bc76f693c07735e99d6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b87-7554-455a-bfed-4b8002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:51.000Z",
|
|
"modified": "2017-04-07T10:35:51.000Z",
|
|
"first_observed": "2017-04-07T10:35:51Z",
|
|
"last_observed": "2017-04-07T10:35:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b87-7554-455a-bfed-4b8002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b87-7554-455a-bfed-4b8002de0b81",
|
|
"value": "https://www.virustotal.com/file/ae5625a0fe39b34884cfd33832181392e9cf5157b8070b2e1b3d04c87fb46eec/analysis/1487392100/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b88-dfe8-4145-8a89-405c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:52.000Z",
|
|
"modified": "2017-04-07T10:35:52.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a8825be2145fb5cc25194aa13f5168ac7ede1132632cdeebadfb640d063fc781",
|
|
"pattern": "[file:hashes.SHA1 = '9e800c50a0119929108600ae11b0bb1068fbef23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b89-a408-401d-b47b-4b7202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:53.000Z",
|
|
"modified": "2017-04-07T10:35:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: a8825be2145fb5cc25194aa13f5168ac7ede1132632cdeebadfb640d063fc781",
|
|
"pattern": "[file:hashes.MD5 = '3dc99568080033d6772a71fc56875687']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b8a-e108-4758-b3d0-400f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:54.000Z",
|
|
"modified": "2017-04-07T10:35:54.000Z",
|
|
"first_observed": "2017-04-07T10:35:54Z",
|
|
"last_observed": "2017-04-07T10:35:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b8a-e108-4758-b3d0-400f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b8a-e108-4758-b3d0-400f02de0b81",
|
|
"value": "https://www.virustotal.com/file/a8825be2145fb5cc25194aa13f5168ac7ede1132632cdeebadfb640d063fc781/analysis/1490994282/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b8b-1614-4eab-996f-49fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:55.000Z",
|
|
"modified": "2017-04-07T10:35:55.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e1addb50f0fea302317c40017fcdad84e1b8bc0f6d5b3f2609de2a0576ad8f9a",
|
|
"pattern": "[file:hashes.SHA1 = '97d9f52309b4b53a717d95cd3d1aafda785f018d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b8c-2df0-433c-af56-40a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:56.000Z",
|
|
"modified": "2017-04-07T10:35:56.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e1addb50f0fea302317c40017fcdad84e1b8bc0f6d5b3f2609de2a0576ad8f9a",
|
|
"pattern": "[file:hashes.MD5 = 'ceef61be02dd90cb8d14742a3aaab362']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b8d-2ed0-4059-bf73-4a3f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:57.000Z",
|
|
"modified": "2017-04-07T10:35:57.000Z",
|
|
"first_observed": "2017-04-07T10:35:57Z",
|
|
"last_observed": "2017-04-07T10:35:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b8d-2ed0-4059-bf73-4a3f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b8d-2ed0-4059-bf73-4a3f02de0b81",
|
|
"value": "https://www.virustotal.com/file/e1addb50f0fea302317c40017fcdad84e1b8bc0f6d5b3f2609de2a0576ad8f9a/analysis/1491513973/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b8d-52ec-4cef-ad31-4acc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:57.000Z",
|
|
"modified": "2017-04-07T10:35:57.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 98553dacbb2fdd8d655907f29e8ba36265f931fd5c6fe83c4defafc10767d4f0",
|
|
"pattern": "[file:hashes.SHA1 = '75fc22b3398fc597d43feccc57563625b350ac2d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b8e-a638-40f1-9efc-4e2b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:58.000Z",
|
|
"modified": "2017-04-07T10:35:58.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 98553dacbb2fdd8d655907f29e8ba36265f931fd5c6fe83c4defafc10767d4f0",
|
|
"pattern": "[file:hashes.MD5 = 'f8dae94ad3a1e36c2cf58ba253544ece']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:35:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b8f-78b0-468b-bc58-4da402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:35:59.000Z",
|
|
"modified": "2017-04-07T10:35:59.000Z",
|
|
"first_observed": "2017-04-07T10:35:59Z",
|
|
"last_observed": "2017-04-07T10:35:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b8f-78b0-468b-bc58-4da402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b8f-78b0-468b-bc58-4da402de0b81",
|
|
"value": "https://www.virustotal.com/file/98553dacbb2fdd8d655907f29e8ba36265f931fd5c6fe83c4defafc10767d4f0/analysis/1482788193/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b90-5a10-409a-b6d3-44e802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:00.000Z",
|
|
"modified": "2017-04-07T10:36:00.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: d5e145bf964b91210b79b25fc92ce19aacacadac14ebeb6f4111b6f4cabfd6c7",
|
|
"pattern": "[file:hashes.SHA1 = '2141e2e4e325b2eadfa4663453c6438f55c1c5b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b91-c798-4568-8bed-4b7d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:01.000Z",
|
|
"modified": "2017-04-07T10:36:01.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: d5e145bf964b91210b79b25fc92ce19aacacadac14ebeb6f4111b6f4cabfd6c7",
|
|
"pattern": "[file:hashes.MD5 = '037410c7ec88795f8cf352104001ea99']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b92-61ac-4053-a624-451e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:02.000Z",
|
|
"modified": "2017-04-07T10:36:02.000Z",
|
|
"first_observed": "2017-04-07T10:36:02Z",
|
|
"last_observed": "2017-04-07T10:36:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b92-61ac-4053-a624-451e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b92-61ac-4053-a624-451e02de0b81",
|
|
"value": "https://www.virustotal.com/file/d5e145bf964b91210b79b25fc92ce19aacacadac14ebeb6f4111b6f4cabfd6c7/analysis/1485281661/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b93-c240-4b0f-9f65-444e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:03.000Z",
|
|
"modified": "2017-04-07T10:36:03.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: cd051cb14f118e33a2299925a704a56d89ba92a310f2176a0942ec29babedee6",
|
|
"pattern": "[file:hashes.SHA1 = '511f889a1b6fa93cf5aeb610a59611c29aa95dd1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b94-5480-4edf-b1ac-4af502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:04.000Z",
|
|
"modified": "2017-04-07T10:36:04.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: cd051cb14f118e33a2299925a704a56d89ba92a310f2176a0942ec29babedee6",
|
|
"pattern": "[file:hashes.MD5 = '4e5f20b8b025830fad872a56cb892d7c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b95-3450-42dd-bc00-431502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:05.000Z",
|
|
"modified": "2017-04-07T10:36:05.000Z",
|
|
"first_observed": "2017-04-07T10:36:05Z",
|
|
"last_observed": "2017-04-07T10:36:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b95-3450-42dd-bc00-431502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b95-3450-42dd-bc00-431502de0b81",
|
|
"value": "https://www.virustotal.com/file/cd051cb14f118e33a2299925a704a56d89ba92a310f2176a0942ec29babedee6/analysis/1491513973/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b96-5270-4d12-bd90-432602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:06.000Z",
|
|
"modified": "2017-04-07T10:36:06.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6c51b3ca96d06cc695de3875f4d31962bb936331a82541ab610f269fec0b0a8c",
|
|
"pattern": "[file:hashes.SHA1 = 'e4fafa98ddc94d1140317db4177720ba5025c905']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b96-ae78-45d0-9ed9-420a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:06.000Z",
|
|
"modified": "2017-04-07T10:36:06.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6c51b3ca96d06cc695de3875f4d31962bb936331a82541ab610f269fec0b0a8c",
|
|
"pattern": "[file:hashes.MD5 = '5823f265f46614a005b6367d211eafb7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b97-6be8-47b3-b636-410402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:07.000Z",
|
|
"modified": "2017-04-07T10:36:07.000Z",
|
|
"first_observed": "2017-04-07T10:36:07Z",
|
|
"last_observed": "2017-04-07T10:36:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b97-6be8-47b3-b636-410402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b97-6be8-47b3-b636-410402de0b81",
|
|
"value": "https://www.virustotal.com/file/6c51b3ca96d06cc695de3875f4d31962bb936331a82541ab610f269fec0b0a8c/analysis/1484271785/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b98-f334-4e6f-91b7-429102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:08.000Z",
|
|
"modified": "2017-04-07T10:36:08.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b8285b66aa42f61de1c43423ea25f8cbe03ebb96d0917c153476e185a5909e57",
|
|
"pattern": "[file:hashes.SHA1 = '795d2da929b3d1ee4798cc13b69ed4c0dcc21984']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b99-2ab0-4f9e-a55b-4f8902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:09.000Z",
|
|
"modified": "2017-04-07T10:36:09.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b8285b66aa42f61de1c43423ea25f8cbe03ebb96d0917c153476e185a5909e57",
|
|
"pattern": "[file:hashes.MD5 = 'd0e2dd20690262b4e468739dff8ffd36']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b9a-e4cc-448f-baf5-47a202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:10.000Z",
|
|
"modified": "2017-04-07T10:36:10.000Z",
|
|
"first_observed": "2017-04-07T10:36:10Z",
|
|
"last_observed": "2017-04-07T10:36:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b9a-e4cc-448f-baf5-47a202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b9a-e4cc-448f-baf5-47a202de0b81",
|
|
"value": "https://www.virustotal.com/file/b8285b66aa42f61de1c43423ea25f8cbe03ebb96d0917c153476e185a5909e57/analysis/1485853019/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b9b-d5f0-40b9-89eb-4dbe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:11.000Z",
|
|
"modified": "2017-04-07T10:36:11.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6eca9aacc7d9ef570bf2521f5a1156825832282650d2d3734d964a834f97b3f4",
|
|
"pattern": "[file:hashes.SHA1 = '59dddcf8f420b8cbb9e52f9d285ee08cc20ac202']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b9c-7968-4dac-8ca3-4ebc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:12.000Z",
|
|
"modified": "2017-04-07T10:36:12.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 6eca9aacc7d9ef570bf2521f5a1156825832282650d2d3734d964a834f97b3f4",
|
|
"pattern": "[file:hashes.MD5 = '20f9250a1fd7534c5d749321c7c28304']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76b9d-f02c-4707-8253-41f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:13.000Z",
|
|
"modified": "2017-04-07T10:36:13.000Z",
|
|
"first_observed": "2017-04-07T10:36:13Z",
|
|
"last_observed": "2017-04-07T10:36:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76b9d-f02c-4707-8253-41f602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76b9d-f02c-4707-8253-41f602de0b81",
|
|
"value": "https://www.virustotal.com/file/6eca9aacc7d9ef570bf2521f5a1156825832282650d2d3734d964a834f97b3f4/analysis/1485892671/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b9e-39a4-437f-af28-427002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:14.000Z",
|
|
"modified": "2017-04-07T10:36:14.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2813409822b56ae81f08adcaed29a215b3bef0e4f1cc5a22c7169f9e16a188a0",
|
|
"pattern": "[file:hashes.SHA1 = '8e3296d8e0c0418f5ce5331056d221f02fa9cd93']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76b9f-bdd8-442e-912c-4d1702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:15.000Z",
|
|
"modified": "2017-04-07T10:36:15.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2813409822b56ae81f08adcaed29a215b3bef0e4f1cc5a22c7169f9e16a188a0",
|
|
"pattern": "[file:hashes.MD5 = '80967033133d4d744bd82266bed76b86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ba0-8dcc-4fef-baec-4faa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:16.000Z",
|
|
"modified": "2017-04-07T10:36:16.000Z",
|
|
"first_observed": "2017-04-07T10:36:16Z",
|
|
"last_observed": "2017-04-07T10:36:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ba0-8dcc-4fef-baec-4faa02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ba0-8dcc-4fef-baec-4faa02de0b81",
|
|
"value": "https://www.virustotal.com/file/2813409822b56ae81f08adcaed29a215b3bef0e4f1cc5a22c7169f9e16a188a0/analysis/1485958372/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba1-8604-4770-bc79-41ca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:17.000Z",
|
|
"modified": "2017-04-07T10:36:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 783486dd30ca43d3a6c6807530c023f61631e4b3e6f2e6c2830b5209ee384e13",
|
|
"pattern": "[file:hashes.SHA1 = 'd118cb59594dd24b4095633cb50f9df80e641fbc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba1-86d4-4382-9549-4ba302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:17.000Z",
|
|
"modified": "2017-04-07T10:36:17.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 783486dd30ca43d3a6c6807530c023f61631e4b3e6f2e6c2830b5209ee384e13",
|
|
"pattern": "[file:hashes.MD5 = '11cdabb1a13205c6d4f43206f674b055']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ba2-0328-4d9c-9c8a-4dea02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:18.000Z",
|
|
"modified": "2017-04-07T10:36:18.000Z",
|
|
"first_observed": "2017-04-07T10:36:18Z",
|
|
"last_observed": "2017-04-07T10:36:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ba2-0328-4d9c-9c8a-4dea02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ba2-0328-4d9c-9c8a-4dea02de0b81",
|
|
"value": "https://www.virustotal.com/file/783486dd30ca43d3a6c6807530c023f61631e4b3e6f2e6c2830b5209ee384e13/analysis/1486273353/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba3-759c-4e4b-be67-4ddb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:19.000Z",
|
|
"modified": "2017-04-07T10:36:19.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 433d2c8a3e93191d09e11994438ec3413152baf64e26e8d9e43c2d2e056b700c",
|
|
"pattern": "[file:hashes.SHA1 = '65e771909ebef1ba52a50c87b9e4b62a3aea5ee0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba4-3708-4c51-a7c4-447302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:20.000Z",
|
|
"modified": "2017-04-07T10:36:20.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 433d2c8a3e93191d09e11994438ec3413152baf64e26e8d9e43c2d2e056b700c",
|
|
"pattern": "[file:hashes.MD5 = '116d824285c32a2bdc6ca5443db8b3ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ba5-ddc4-4d09-a72e-4a5a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:21.000Z",
|
|
"modified": "2017-04-07T10:36:21.000Z",
|
|
"first_observed": "2017-04-07T10:36:21Z",
|
|
"last_observed": "2017-04-07T10:36:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ba5-ddc4-4d09-a72e-4a5a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ba5-ddc4-4d09-a72e-4a5a02de0b81",
|
|
"value": "https://www.virustotal.com/file/433d2c8a3e93191d09e11994438ec3413152baf64e26e8d9e43c2d2e056b700c/analysis/1490097084/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba6-3134-4b83-a4b8-493602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:22.000Z",
|
|
"modified": "2017-04-07T10:36:22.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: beb05e01b87e1a432b3ef37eb55db723a5a5231872a53ab777d7821358e97574",
|
|
"pattern": "[file:hashes.SHA1 = '1731835d5038c605d30b80fcb2b19dac2f00202c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba7-e174-4dfd-b5a7-4e6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:23.000Z",
|
|
"modified": "2017-04-07T10:36:23.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: beb05e01b87e1a432b3ef37eb55db723a5a5231872a53ab777d7821358e97574",
|
|
"pattern": "[file:hashes.MD5 = 'ba062c23a468c803abe787d23350807c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76ba8-d0d4-4440-8159-488b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:24.000Z",
|
|
"modified": "2017-04-07T10:36:24.000Z",
|
|
"first_observed": "2017-04-07T10:36:24Z",
|
|
"last_observed": "2017-04-07T10:36:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76ba8-d0d4-4440-8159-488b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76ba8-d0d4-4440-8159-488b02de0b81",
|
|
"value": "https://www.virustotal.com/file/beb05e01b87e1a432b3ef37eb55db723a5a5231872a53ab777d7821358e97574/analysis/1491513972/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76ba9-ae5c-4f47-b5f5-485b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:25.000Z",
|
|
"modified": "2017-04-07T10:36:25.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1184916919ea9790adcd53b60c4bf875e54733e508344ffe6baf10b919a0fd1d",
|
|
"pattern": "[file:hashes.SHA1 = 'b7e4adbc2ecfa634bcb37364fa2a78476421307f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76baa-c524-496c-8429-46cf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:26.000Z",
|
|
"modified": "2017-04-07T10:36:26.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1184916919ea9790adcd53b60c4bf875e54733e508344ffe6baf10b919a0fd1d",
|
|
"pattern": "[file:hashes.MD5 = 'b6507e6ff1bda8b105d3712a038017d6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bab-41bc-4785-81af-4d6d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:27.000Z",
|
|
"modified": "2017-04-07T10:36:27.000Z",
|
|
"first_observed": "2017-04-07T10:36:27Z",
|
|
"last_observed": "2017-04-07T10:36:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bab-41bc-4785-81af-4d6d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bab-41bc-4785-81af-4d6d02de0b81",
|
|
"value": "https://www.virustotal.com/file/1184916919ea9790adcd53b60c4bf875e54733e508344ffe6baf10b919a0fd1d/analysis/1486913705/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bac-1ca0-4133-92f4-4f1402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:28.000Z",
|
|
"modified": "2017-04-07T10:36:28.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 9ae853b1e678926358ac8c1cd583eb2d5968b99c2a16cf34334a22051bb630ec",
|
|
"pattern": "[file:hashes.SHA1 = '8982afeacdaaef2b8a49212e5668db45e730ae7c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bad-5140-4d22-a4a6-40bf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:29.000Z",
|
|
"modified": "2017-04-07T10:36:29.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 9ae853b1e678926358ac8c1cd583eb2d5968b99c2a16cf34334a22051bb630ec",
|
|
"pattern": "[file:hashes.MD5 = '7897cf3de02a5dfcfd2c32d8c0e08f58']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bae-b180-4606-9022-4c1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:30.000Z",
|
|
"modified": "2017-04-07T10:36:30.000Z",
|
|
"first_observed": "2017-04-07T10:36:30Z",
|
|
"last_observed": "2017-04-07T10:36:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bae-b180-4606-9022-4c1d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bae-b180-4606-9022-4c1d02de0b81",
|
|
"value": "https://www.virustotal.com/file/9ae853b1e678926358ac8c1cd583eb2d5968b99c2a16cf34334a22051bb630ec/analysis/1489396003/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76baf-ce9c-43ab-98de-4e0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:31.000Z",
|
|
"modified": "2017-04-07T10:36:31.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 325c5aa819dbd1596464ec018b9efb5938dbc59ac6a94c459932ef07412bca02",
|
|
"pattern": "[file:hashes.SHA1 = '0b4609cf4e1fe3a5d621a99e17dde4df6da933cb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb0-b6cc-4ff6-ae2d-47fb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:32.000Z",
|
|
"modified": "2017-04-07T10:36:32.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 325c5aa819dbd1596464ec018b9efb5938dbc59ac6a94c459932ef07412bca02",
|
|
"pattern": "[file:hashes.MD5 = '79e5f56d244044aab2f6760147524c57']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bb1-a7ec-4a6a-8bc2-471502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:33.000Z",
|
|
"modified": "2017-04-07T10:36:33.000Z",
|
|
"first_observed": "2017-04-07T10:36:33Z",
|
|
"last_observed": "2017-04-07T10:36:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bb1-a7ec-4a6a-8bc2-471502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bb1-a7ec-4a6a-8bc2-471502de0b81",
|
|
"value": "https://www.virustotal.com/file/325c5aa819dbd1596464ec018b9efb5938dbc59ac6a94c459932ef07412bca02/analysis/1491498268/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb2-ad48-429f-a9dc-4a3502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:34.000Z",
|
|
"modified": "2017-04-07T10:36:34.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1bbd9498f50259917d737b70a875772f963424f69fb942b86d626283e154cab2",
|
|
"pattern": "[file:hashes.SHA1 = '6829b1cc87108a1034961e397684620a60e5ea94']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb3-d148-4ad3-840d-43d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:35.000Z",
|
|
"modified": "2017-04-07T10:36:35.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1bbd9498f50259917d737b70a875772f963424f69fb942b86d626283e154cab2",
|
|
"pattern": "[file:hashes.MD5 = '15b923d32ba8efdfee719d503921b91d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bb3-1198-47b4-942f-4e2502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:35.000Z",
|
|
"modified": "2017-04-07T10:36:35.000Z",
|
|
"first_observed": "2017-04-07T10:36:35Z",
|
|
"last_observed": "2017-04-07T10:36:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bb3-1198-47b4-942f-4e2502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bb3-1198-47b4-942f-4e2502de0b81",
|
|
"value": "https://www.virustotal.com/file/1bbd9498f50259917d737b70a875772f963424f69fb942b86d626283e154cab2/analysis/1491513971/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb4-ecf4-4153-a5a8-45be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:36.000Z",
|
|
"modified": "2017-04-07T10:36:36.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b384ed2a4f484b70786e5ea84ff513d30fe4d068fd76cc214d448f7f1c4329fb",
|
|
"pattern": "[file:hashes.SHA1 = 'f5bd0ddee99547e98c1ff6db9d38ab3e9572a07d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb5-ab38-4ac2-9c4f-46cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:37.000Z",
|
|
"modified": "2017-04-07T10:36:37.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: b384ed2a4f484b70786e5ea84ff513d30fe4d068fd76cc214d448f7f1c4329fb",
|
|
"pattern": "[file:hashes.MD5 = '14afcccac89c31782f5150ae1c8c6267']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bb6-1ea4-4080-b353-451802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:38.000Z",
|
|
"modified": "2017-04-07T10:36:38.000Z",
|
|
"first_observed": "2017-04-07T10:36:38Z",
|
|
"last_observed": "2017-04-07T10:36:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bb6-1ea4-4080-b353-451802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bb6-1ea4-4080-b353-451802de0b81",
|
|
"value": "https://www.virustotal.com/file/b384ed2a4f484b70786e5ea84ff513d30fe4d068fd76cc214d448f7f1c4329fb/analysis/1491498200/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb7-c3a0-4752-aaee-42df02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:39.000Z",
|
|
"modified": "2017-04-07T10:36:39.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1bb2a7a6c271b7e607cf87f2a4003eae1653f304cde104fc0311611cbb96e431",
|
|
"pattern": "[file:hashes.SHA1 = 'ff973505a78722cfceac8902aa9d90fde037d782']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bb8-9748-4166-a4af-404002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:40.000Z",
|
|
"modified": "2017-04-07T10:36:40.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 1bb2a7a6c271b7e607cf87f2a4003eae1653f304cde104fc0311611cbb96e431",
|
|
"pattern": "[file:hashes.MD5 = '79d499693b9444155d99e19ce9a9a155']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bb9-6f70-4dbd-b83d-4afe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:41.000Z",
|
|
"modified": "2017-04-07T10:36:41.000Z",
|
|
"first_observed": "2017-04-07T10:36:41Z",
|
|
"last_observed": "2017-04-07T10:36:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bb9-6f70-4dbd-b83d-4afe02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bb9-6f70-4dbd-b83d-4afe02de0b81",
|
|
"value": "https://www.virustotal.com/file/1bb2a7a6c271b7e607cf87f2a4003eae1653f304cde104fc0311611cbb96e431/analysis/1491513970/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bba-7c38-4bc7-8b84-470202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:42.000Z",
|
|
"modified": "2017-04-07T10:36:42.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: fcfe51fd23aadcab5a7878bd59b5354d3491d237b259e230ac51e49306b253c7",
|
|
"pattern": "[file:hashes.SHA1 = '7226907a612c68f6bae6b1c0634571a8ff9012e8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bbb-ece4-4c6b-b9f6-45d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:43.000Z",
|
|
"modified": "2017-04-07T10:36:43.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: fcfe51fd23aadcab5a7878bd59b5354d3491d237b259e230ac51e49306b253c7",
|
|
"pattern": "[file:hashes.MD5 = 'bd2a0c55765eb01644346760983dc814']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bbc-1180-430c-ac75-429c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:44.000Z",
|
|
"modified": "2017-04-07T10:36:44.000Z",
|
|
"first_observed": "2017-04-07T10:36:44Z",
|
|
"last_observed": "2017-04-07T10:36:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bbc-1180-430c-ac75-429c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bbc-1180-430c-ac75-429c02de0b81",
|
|
"value": "https://www.virustotal.com/file/fcfe51fd23aadcab5a7878bd59b5354d3491d237b259e230ac51e49306b253c7/analysis/1491513970/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bbd-2e54-47ab-960e-4ecb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:45.000Z",
|
|
"modified": "2017-04-07T10:36:45.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2709506acdb0c6aba5ce794ceada11b64078f5731b91359cb398bc967cb67eba",
|
|
"pattern": "[file:hashes.SHA1 = 'c4d5dd608cffb85ea84292fdfad05927c070e1a4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bbe-6f74-4501-884c-462102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:46.000Z",
|
|
"modified": "2017-04-07T10:36:46.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2709506acdb0c6aba5ce794ceada11b64078f5731b91359cb398bc967cb67eba",
|
|
"pattern": "[file:hashes.MD5 = 'b076ec4e69ada4900b16807b45d1a53d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bbf-a7d8-4c8d-aa5f-403702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:47.000Z",
|
|
"modified": "2017-04-07T10:36:47.000Z",
|
|
"first_observed": "2017-04-07T10:36:47Z",
|
|
"last_observed": "2017-04-07T10:36:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bbf-a7d8-4c8d-aa5f-403702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bbf-a7d8-4c8d-aa5f-403702de0b81",
|
|
"value": "https://www.virustotal.com/file/2709506acdb0c6aba5ce794ceada11b64078f5731b91359cb398bc967cb67eba/analysis/1491513969/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bbf-133c-433e-991a-451702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:47.000Z",
|
|
"modified": "2017-04-07T10:36:47.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e9050c541859f2fabff6dcd492df02a48dd32d99b1f3e98ef7c14bbb6aa734a2",
|
|
"pattern": "[file:hashes.SHA1 = '4752a539013edb3930526ecaa2c6f5a2c8e2c48c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc0-1f64-4c3e-8772-4a0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:48.000Z",
|
|
"modified": "2017-04-07T10:36:48.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: e9050c541859f2fabff6dcd492df02a48dd32d99b1f3e98ef7c14bbb6aa734a2",
|
|
"pattern": "[file:hashes.MD5 = '78919ee718f9bd683d75b466e4ba70fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bc1-1aa8-4a2b-98ed-400c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:49.000Z",
|
|
"modified": "2017-04-07T10:36:49.000Z",
|
|
"first_observed": "2017-04-07T10:36:49Z",
|
|
"last_observed": "2017-04-07T10:36:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bc1-1aa8-4a2b-98ed-400c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bc1-1aa8-4a2b-98ed-400c02de0b81",
|
|
"value": "https://www.virustotal.com/file/e9050c541859f2fabff6dcd492df02a48dd32d99b1f3e98ef7c14bbb6aa734a2/analysis/1491513970/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc2-d2e0-4d34-b339-4daa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:50.000Z",
|
|
"modified": "2017-04-07T10:36:50.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2c8a67f8118b6aef159dd280d5998b1c41edb406a1bc8e3960254a9642b6ae4b",
|
|
"pattern": "[file:hashes.SHA1 = 'ce8c584cb3f633b0c4e091466bda398ccdd59cfd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc3-5dc8-4e04-9436-4c9802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:51.000Z",
|
|
"modified": "2017-04-07T10:36:51.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 2c8a67f8118b6aef159dd280d5998b1c41edb406a1bc8e3960254a9642b6ae4b",
|
|
"pattern": "[file:hashes.MD5 = '6462bdc3c6a5efb11e066853a757164a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bc4-9240-4446-892b-4bac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:52.000Z",
|
|
"modified": "2017-04-07T10:36:52.000Z",
|
|
"first_observed": "2017-04-07T10:36:52Z",
|
|
"last_observed": "2017-04-07T10:36:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bc4-9240-4446-892b-4bac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bc4-9240-4446-892b-4bac02de0b81",
|
|
"value": "https://www.virustotal.com/file/2c8a67f8118b6aef159dd280d5998b1c41edb406a1bc8e3960254a9642b6ae4b/analysis/1491513969/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc5-dfe0-4035-84be-4f8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:53.000Z",
|
|
"modified": "2017-04-07T10:36:53.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4c1973278a30d1b4ce206eca63676624d234260758a0674d191d338a02914d23",
|
|
"pattern": "[file:hashes.SHA1 = 'bf44eb0c876cf2fea70b80d85f4cf04c2ee4171d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc6-5518-46b6-8ab2-46f702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:54.000Z",
|
|
"modified": "2017-04-07T10:36:54.000Z",
|
|
"description": "KASPERAGENT - Xchecked via VT: 4c1973278a30d1b4ce206eca63676624d234260758a0674d191d338a02914d23",
|
|
"pattern": "[file:hashes.MD5 = 'c548cea3b6d00776f322182a77e94ae5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bc7-597c-4f2c-bb7e-4b4502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:55.000Z",
|
|
"modified": "2017-04-07T10:36:55.000Z",
|
|
"first_observed": "2017-04-07T10:36:55Z",
|
|
"last_observed": "2017-04-07T10:36:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bc7-597c-4f2c-bb7e-4b4502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bc7-597c-4f2c-bb7e-4b4502de0b81",
|
|
"value": "https://www.virustotal.com/file/4c1973278a30d1b4ce206eca63676624d234260758a0674d191d338a02914d23/analysis/1491513976/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc8-5fc8-492f-a849-48fd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:56.000Z",
|
|
"modified": "2017-04-07T10:36:56.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: 7f11e0bbc892a97b7c42416c43fe178ebb240939d9dee70c3c598305ce8a2d4f",
|
|
"pattern": "[file:hashes.SHA1 = '9c73e3082767191ea528e9ff6b779bcfc73777b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bc9-5c58-4986-b3f4-4eda02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:57.000Z",
|
|
"modified": "2017-04-07T10:36:57.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: 7f11e0bbc892a97b7c42416c43fe178ebb240939d9dee70c3c598305ce8a2d4f",
|
|
"pattern": "[file:hashes.MD5 = 'fc8cb7e39d5b54740f0cf3d44e3de5e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bca-f3e0-4b9b-ab90-417f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:58.000Z",
|
|
"modified": "2017-04-07T10:36:58.000Z",
|
|
"first_observed": "2017-04-07T10:36:58Z",
|
|
"last_observed": "2017-04-07T10:36:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bca-f3e0-4b9b-ab90-417f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bca-f3e0-4b9b-ab90-417f02de0b81",
|
|
"value": "https://www.virustotal.com/file/7f11e0bbc892a97b7c42416c43fe178ebb240939d9dee70c3c598305ce8a2d4f/analysis/1491317332/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bcb-fc94-4064-9988-4dae02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:36:59.000Z",
|
|
"modified": "2017-04-07T10:36:59.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: c9ffb81a97a9458f1fc96f35cd187b1d7311479e77d031586abdc3d426da0859",
|
|
"pattern": "[file:hashes.SHA1 = '1e4e28d02f054291e67faea6632cc6c0357c7892']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:36:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bcc-8cb8-41ac-af0b-471802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:00.000Z",
|
|
"modified": "2017-04-07T10:37:00.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: c9ffb81a97a9458f1fc96f35cd187b1d7311479e77d031586abdc3d426da0859",
|
|
"pattern": "[file:hashes.MD5 = '03b14dff4714e11e6cfa5f78d976a432']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bcd-d1b0-4f6f-bf3e-4a2202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:01.000Z",
|
|
"modified": "2017-04-07T10:37:01.000Z",
|
|
"first_observed": "2017-04-07T10:37:01Z",
|
|
"last_observed": "2017-04-07T10:37:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bcd-d1b0-4f6f-bf3e-4a2202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bcd-d1b0-4f6f-bf3e-4a2202de0b81",
|
|
"value": "https://www.virustotal.com/file/c9ffb81a97a9458f1fc96f35cd187b1d7311479e77d031586abdc3d426da0859/analysis/1491513991/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bce-d590-4b11-a85a-4e6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:02.000Z",
|
|
"modified": "2017-04-07T10:37:02.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: a52d3e65fe5bbf57bab79b1c5092b66d9650247249b72f667a927f266d09efe6",
|
|
"pattern": "[file:hashes.SHA1 = '055c2921180f2153e57f870b135f32382078c3c8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bcf-e9c4-4e2f-95a6-48f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:03.000Z",
|
|
"modified": "2017-04-07T10:37:03.000Z",
|
|
"description": "extended-capability KASPERAGENT samples - Xchecked via VT: a52d3e65fe5bbf57bab79b1c5092b66d9650247249b72f667a927f266d09efe6",
|
|
"pattern": "[file:hashes.MD5 = 'f63c43dbaf805c9321ec61ea64d70781']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bcf-2a80-4064-8d59-4cb202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:03.000Z",
|
|
"modified": "2017-04-07T10:37:03.000Z",
|
|
"first_observed": "2017-04-07T10:37:03Z",
|
|
"last_observed": "2017-04-07T10:37:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bcf-2a80-4064-8d59-4cb202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bcf-2a80-4064-8d59-4cb202de0b81",
|
|
"value": "https://www.virustotal.com/file/a52d3e65fe5bbf57bab79b1c5092b66d9650247249b72f667a927f266d09efe6/analysis/1451299229/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd0-8c20-47d0-b1c6-42fe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:04.000Z",
|
|
"modified": "2017-04-07T10:37:04.000Z",
|
|
"description": "C:\\vault\\igfxtray.exe - Xchecked via VT: f26caee34184b6a53ecbc0b5ce1f52e17d39af2129561dd6361fb4d4364e2c8b",
|
|
"pattern": "[file:hashes.SHA1 = 'f1f7a15397abed41508d7dd462e4c8adf5fb8a38']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd1-71ac-4bf2-8b75-430802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:05.000Z",
|
|
"modified": "2017-04-07T10:37:05.000Z",
|
|
"description": "C:\\vault\\igfxtray.exe - Xchecked via VT: f26caee34184b6a53ecbc0b5ce1f52e17d39af2129561dd6361fb4d4364e2c8b",
|
|
"pattern": "[file:hashes.MD5 = 'cb336cea05ef664c2796209770f5d624']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bd2-3080-4174-989e-49d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:06.000Z",
|
|
"modified": "2017-04-07T10:37:06.000Z",
|
|
"first_observed": "2017-04-07T10:37:06Z",
|
|
"last_observed": "2017-04-07T10:37:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bd2-3080-4174-989e-49d402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bd2-3080-4174-989e-49d402de0b81",
|
|
"value": "https://www.virustotal.com/file/f26caee34184b6a53ecbc0b5ce1f52e17d39af2129561dd6361fb4d4364e2c8b/analysis/1488363403/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd3-d8f8-49eb-a354-418a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:07.000Z",
|
|
"modified": "2017-04-07T10:37:07.000Z",
|
|
"description": "- Xchecked via VT: babd654ef363e0645ce374dd9e2a42afe339c52f1cf17fc2285d8bebd3cfa11e",
|
|
"pattern": "[file:hashes.SHA1 = '042984906ab211228002ea0292980abfbaedbbe7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd4-7098-4b33-9156-47eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:08.000Z",
|
|
"modified": "2017-04-07T10:37:08.000Z",
|
|
"description": "- Xchecked via VT: babd654ef363e0645ce374dd9e2a42afe339c52f1cf17fc2285d8bebd3cfa11e",
|
|
"pattern": "[file:hashes.MD5 = '97ae35d36c7434ef770e1a7fead55276']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bd5-9ddc-488f-9762-4b1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:09.000Z",
|
|
"modified": "2017-04-07T10:37:09.000Z",
|
|
"first_observed": "2017-04-07T10:37:09Z",
|
|
"last_observed": "2017-04-07T10:37:09Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bd5-9ddc-488f-9762-4b1602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bd5-9ddc-488f-9762-4b1602de0b81",
|
|
"value": "https://www.virustotal.com/file/babd654ef363e0645ce374dd9e2a42afe339c52f1cf17fc2285d8bebd3cfa11e/analysis/1491513971/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd6-b85c-4524-b9e1-440502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:10.000Z",
|
|
"modified": "2017-04-07T10:37:10.000Z",
|
|
"description": "sample of KASPERAGENT hosted on drive.acount-manager[.]net - Xchecked via VT: babf156ede8b5c2e6c961b6ffcccc5eb7a3d283b398370754061613f439d40f9",
|
|
"pattern": "[file:hashes.SHA1 = 'ee937464f085dde4aa9d608410f58079803712ae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58e76bd7-b330-44e9-b8dc-4c0c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:11.000Z",
|
|
"modified": "2017-04-07T10:37:11.000Z",
|
|
"description": "sample of KASPERAGENT hosted on drive.acount-manager[.]net - Xchecked via VT: babf156ede8b5c2e6c961b6ffcccc5eb7a3d283b398370754061613f439d40f9",
|
|
"pattern": "[file:hashes.MD5 = '240105a1510f6e4f5c40a64c98971bac']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-04-07T10:37:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58e76bd8-de48-4e4e-b30c-401a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-04-07T10:37:12.000Z",
|
|
"modified": "2017-04-07T10:37:12.000Z",
|
|
"first_observed": "2017-04-07T10:37:12Z",
|
|
"last_observed": "2017-04-07T10:37:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58e76bd8-de48-4e4e-b30c-401a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58e76bd8-de48-4e4e-b30c-401a02de0b81",
|
|
"value": "https://www.virustotal.com/file/babf156ede8b5c2e6c961b6ffcccc5eb7a3d283b398370754061613f439d40f9/analysis/1491513979/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |