adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5a04081b-1654-407b-80f9-46a9950d210f.json

363 lines
No EOL
15 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5a04081b-1654-407b-80f9-46a9950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:59.000Z",
"modified": "2017-11-09T08:21:59.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "grouping",
"spec_version": "2.1",
"id": "grouping--5a04081b-1654-407b-80f9-46a9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:59.000Z",
"modified": "2017-11-09T08:21:59.000Z",
"name": "OSINT - OilRig Deploys \u201cALMA Communicator\u201d \u2013 DNS Tunneling Trojan",
"context": "suspicious-activity",
"object_refs": [
"observed-data--5a040899-ff14-4f6e-8fce-4ac8950d210f",
"url--5a040899-ff14-4f6e-8fce-4ac8950d210f",
"x-misp-attribute--5a0408ac-f5e0-430a-8d0e-490f950d210f",
"indicator--5a040988-82c0-48fa-8bad-40a1950d210f",
"indicator--5a040988-580c-4788-ae7a-474c950d210f",
"indicator--5a040a7a-14ac-42ec-b859-4917950d210f",
"indicator--5a040cb2-1658-4d1a-ab52-48dd950d210f",
"indicator--5a040cb2-d864-46ee-8d33-4b0f950d210f",
"indicator--5a040ceb-7ed8-468b-ac4f-4444950d210f",
"indicator--5a041021-e6ec-4cd3-bde9-4f6a02de0b81",
"indicator--5a041021-aa14-4a95-b6fc-4cf102de0b81",
"observed-data--5a041021-e614-4721-837e-415e02de0b81",
"url--5a041021-e614-4721-837e-415e02de0b81",
"indicator--5a040b9c-8a74-4aa8-9fda-4da5950d210f",
"indicator--5a040c07-dba0-4d92-aa66-49b0950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:threat-actor=\"OilRig\"",
"type:OSINT",
"osint:source-type=\"blog-post\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a040899-ff14-4f6e-8fce-4ac8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:52.000Z",
"modified": "2017-11-09T08:21:52.000Z",
"first_observed": "2017-11-09T08:21:52Z",
"last_observed": "2017-11-09T08:21:52Z",
"number_observed": 1,
"object_refs": [
"url--5a040899-ff14-4f6e-8fce-4ac8950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a040899-ff14-4f6e-8fce-4ac8950d210f",
"value": "https://researchcenter.paloaltonetworks.com/2017/11/unit42-oilrig-deploys-alma-communicator-dns-tunneling-trojan/"
},
{
"type": "x-misp-attribute",
"spec_version": "2.1",
"id": "x-misp-attribute--5a0408ac-f5e0-430a-8d0e-490f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:52.000Z",
"modified": "2017-11-09T08:21:52.000Z",
"labels": [
"misp:type=\"comment\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
],
"x_misp_category": "External analysis",
"x_misp_type": "comment",
"x_misp_value": "Unit 42 has been closely tracking the OilRig threat group since May 2016. One technique we\u2019ve been tracking with this threat group is their use of the Clayslide delivery document as attachments to spear-phishing emails in attacks since May 2016. In our April 2017 posting OilRig Actors Provide a Glimpse into Development and Testing Efforts we showed how we observed the OilRig threat group developing and refining these Clayside delivery documents."
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040988-82c0-48fa-8bad-40a1950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:52.000Z",
"modified": "2017-11-09T08:21:52.000Z",
"description": "Clayslide",
"pattern": "[file:hashes.SHA256 = 'f37b1bbf5a07759f10e0298b861b354cee13f325bc76fbddfaacd1ea7505e111']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040988-580c-4788-ae7a-474c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:52.000Z",
"modified": "2017-11-09T08:21:52.000Z",
"pattern": "[domain-name:value = 'prosalar.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040a7a-14ac-42ec-b859-4917950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"pattern": "[file:name = 'cfg']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040cb2-1658-4d1a-ab52-48dd950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '36.37.94.33']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040cb2-d864-46ee-8d33-4b0f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '33.33.94.94']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040ceb-7ed8-468b-ac4f-4444950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"pattern": "[file:name = '_DnsInit.bat']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a041021-e6ec-4cd3-bde9-4f6a02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"description": "Clayslide - Xchecked via VT: f37b1bbf5a07759f10e0298b861b354cee13f325bc76fbddfaacd1ea7505e111",
"pattern": "[file:hashes.SHA1 = 'fdf5cda685a6adee0cb8afb8e080f1de472effda']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha1\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a041021-aa14-4a95-b6fc-4cf102de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"description": "Clayslide - Xchecked via VT: f37b1bbf5a07759f10e0298b861b354cee13f325bc76fbddfaacd1ea7505e111",
"pattern": "[file:hashes.MD5 = 'f4de44ed5e6c4c6f19fba5856f0dac40']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:21:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5a041021-e614-4721-837e-415e02de0b81",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:21:53.000Z",
"modified": "2017-11-09T08:21:53.000Z",
"first_observed": "2017-11-09T08:21:53Z",
"last_observed": "2017-11-09T08:21:53Z",
"number_observed": 1,
"object_refs": [
"url--5a041021-e614-4721-837e-415e02de0b81"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5a041021-e614-4721-837e-415e02de0b81",
"value": "https://www.virustotal.com/file/f37b1bbf5a07759f10e0298b861b354cee13f325bc76fbddfaacd1ea7505e111/analysis/1510205105/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040b9c-8a74-4aa8-9fda-4da5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:02:36.000Z",
"modified": "2017-11-09T08:02:36.000Z",
"description": "ALMA Communicator",
"pattern": "[file:hashes.SHA256 = '2fc7810a316863a5a5076bf3078ac6fad246bc8773a5fb835e0993609e5bb62e' AND file:name = 'SystemSyncs.exe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:02:36Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5a040c07-dba0-4d92-aa66-49b0950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2017-11-09T08:04:23.000Z",
"modified": "2017-11-09T08:04:23.000Z",
"description": "Mimikatz",
"pattern": "[file:hashes.SHA256 = '2d6f06d8ee0da16d2335f26eb18cd1f620c4db3e880efa6a5999eff53b12415c' AND file:name = 'm6.e' AND file:x_misp_state = 'Harmless']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2017-11-09T08:04:23Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink