853 lines
No EOL
36 KiB
JSON
853 lines
No EOL
36 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5af412ea-4254-4668-b1ea-44bc950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:36.000Z",
|
|
"modified": "2018-05-10T10:42:36.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5af412ea-4254-4668-b1ea-44bc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:36.000Z",
|
|
"modified": "2018-05-10T10:42:36.000Z",
|
|
"name": "OSINT - Botnet exploiting GPON Vulnerability",
|
|
"published": "2018-05-10T10:50:50Z",
|
|
"object_refs": [
|
|
"observed-data--5af412f6-37f8-4996-8b4c-4055950d210f",
|
|
"url--5af412f6-37f8-4996-8b4c-4055950d210f",
|
|
"indicator--5af41315-9390-4d7f-9def-402b950d210f",
|
|
"indicator--5af41316-1d0c-4ae9-8e42-4a83950d210f",
|
|
"indicator--5af41316-6910-4920-bb47-4788950d210f",
|
|
"indicator--5af41317-4ca4-419f-b092-4144950d210f",
|
|
"indicator--5af41317-5d4c-40bb-9e4d-4c37950d210f",
|
|
"indicator--5af41322-2c5c-487f-a025-46ec950d210f",
|
|
"indicator--5af41348-d5a0-4482-846d-4c7f950d210f",
|
|
"indicator--5af41349-06b0-47c3-8da5-4703950d210f",
|
|
"indicator--5af41349-c1f0-436e-87c0-4205950d210f",
|
|
"indicator--5af4134a-1078-43b5-a581-41bf950d210f",
|
|
"indicator--5af4134a-2874-441f-82e0-4014950d210f",
|
|
"indicator--5af4134a-fe74-4b74-b27f-4a30950d210f",
|
|
"indicator--5af4134b-a0dc-48d8-ab6a-45b3950d210f",
|
|
"indicator--5af4134b-b314-4513-a092-4162950d210f",
|
|
"indicator--5af4134c-c124-4199-aa8a-47da950d210f",
|
|
"vulnerability--5af42049-af54-4183-b0f9-4141950d210f",
|
|
"vulnerability--5af4206b-3850-44de-8419-46ce950d210f",
|
|
"x-misp-attribute--5af42165-4184-439e-ba46-4ac0950d210f",
|
|
"indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
|
|
"x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69",
|
|
"indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
|
|
"x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85",
|
|
"indicator--45af68f9-c923-46f1-8109-faecfda308db",
|
|
"x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c",
|
|
"indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
|
|
"x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250",
|
|
"indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
|
|
"x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c",
|
|
"relationship--e0be4445-87d0-4b95-aae0-e1589790dce7",
|
|
"relationship--6d06ff82-97a7-4a1a-bbec-859ce3376d7d",
|
|
"relationship--9c7c3624-0ef6-44a7-96e8-315ab6f01b20",
|
|
"relationship--1f8ef554-ff78-4b28-aaa6-ad0b2ddabed4",
|
|
"relationship--818a8499-e570-4dbc-bd3b-3ef1b29c42e9"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"malware_classification:malware-category=\"Botnet\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5af412f6-37f8-4996-8b4c-4055950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"first_observed": "2018-05-10T10:42:33Z",
|
|
"last_observed": "2018-05-10T10:42:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5af412f6-37f8-4996-8b4c-4055950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5af412f6-37f8-4996-8b4c-4055950d210f",
|
|
"value": "https://otx.alienvault.com/pulse/5af4123acb33890af1f6e769"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41315-9390-4d7f-9def-402b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41316-1d0c-4ae9-8e42-4a83950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41316-6910-4920-bb47-4788950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41317-4ca4-419f-b092-4144950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41317-5d4c-40bb-9e4d-4c37950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41322-2c5c-487f-a025-46ec950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.62.190.191']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41348-d5a0-4482-846d-4c7f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/arm']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41349-06b0-47c3-8da5-4703950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/arm.shell']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af41349-c1f0-436e-87c0-4205950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/arm7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134a-1078-43b5-a581-41bf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/arm7.shell']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134a-2874-441f-82e0-4014950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/mips']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134a-fe74-4b74-b27f-4a30950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/mips.shell']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134b-a0dc-48d8-ab6a-45b3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/mipsel']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134b-b314-4513-a092-4162950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/mipsel.shell']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5af4134c-c124-4199-aa8a-47da950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"pattern": "[url:value = 'http://185.62.190.191/r']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T10:42:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5af42049-af54-4183-b0f9-4141950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"name": "CVE-2018-10561",
|
|
"labels": [
|
|
"misp:type=\"vulnerability\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2018-10561"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5af4206b-3850-44de-8419-46ce950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"name": "CVE-2018-10562",
|
|
"labels": [
|
|
"misp:type=\"vulnerability\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2018-10562"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5af42165-4184-439e-ba46-4ac0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T10:42:33.000Z",
|
|
"modified": "2018-05-10T10:42:33.000Z",
|
|
"labels": [
|
|
"misp:type=\"cpe\"",
|
|
"misp:category=\"Other\""
|
|
],
|
|
"x_misp_category": "Other",
|
|
"x_misp_type": "cpe",
|
|
"x_misp_value": "cpe:2.3:h:dasannetworks"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:34.000Z",
|
|
"modified": "2018-05-10T09:39:34.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd546bc209d315ae81869315e8d536f36' AND file:hashes.SHA1 = '06f08af784b24a55018b4489afab19f0436b90a9' AND file:hashes.SHA256 = 'efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T09:39:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:33.000Z",
|
|
"modified": "2018-05-10T09:39:33.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-05-10T06:56:45",
|
|
"category": "Other",
|
|
"uuid": "45b43d13-842d-4667-8659-91fb716c6d9b"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/efa4fe06e4949c0f7aedea61a79da92e379ea66b169cd1d99c47b9e93e814093/analysis/1525935405/",
|
|
"category": "External analysis",
|
|
"uuid": "8996de04-2834-4353-8557-def8438f0b8c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/58",
|
|
"category": "Other",
|
|
"uuid": "2d469a44-218a-47d4-bd14-28ceac501c0a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:37.000Z",
|
|
"modified": "2018-05-10T09:39:37.000Z",
|
|
"pattern": "[file:hashes.MD5 = '21fa1dcc069309245a8aa1c142f112a3' AND file:hashes.SHA1 = 'c724be3b4cc8b7e0fbac7d0391be0f2aea0b5b19' AND file:hashes.SHA256 = 'a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T09:39:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:35.000Z",
|
|
"modified": "2018-05-10T09:39:35.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-05-10T08:31:41",
|
|
"category": "Other",
|
|
"uuid": "c4e03498-2663-4831-bcfb-f890f3dd4046"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a79964ce5cf4b92f996bbc24230e102b94ef05fb072c0afdeabc88d28695cace/analysis/1525941101/",
|
|
"category": "External analysis",
|
|
"uuid": "85e41194-4be4-4c8b-9f59-688047946889"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/60",
|
|
"category": "Other",
|
|
"uuid": "a6c92bca-84f0-49c4-b8db-91bd00ccaa53"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--45af68f9-c923-46f1-8109-faecfda308db",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:39.000Z",
|
|
"modified": "2018-05-10T09:39:39.000Z",
|
|
"pattern": "[file:hashes.MD5 = '2adb540db754366a1aa04ccca7105c80' AND file:hashes.SHA1 = '041dcbad0ca62255129048636afec9b89b65a748' AND file:hashes.SHA256 = '1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T09:39:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:37.000Z",
|
|
"modified": "2018-05-10T09:39:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-05-10T08:31:14",
|
|
"category": "Other",
|
|
"uuid": "4f02463a-2c20-4c36-848f-4feeb763163b"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/1ff787d52bc9e4a6c27d75b1a427c3e5dd16d6d5f082a79227c14edf8e908ab2/analysis/1525941074/",
|
|
"category": "External analysis",
|
|
"uuid": "744f3382-cfa3-4a58-9f5d-7be052b795fd"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/52",
|
|
"category": "Other",
|
|
"uuid": "dffbc1c1-8b01-4108-b226-51be41118f85"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:41.000Z",
|
|
"modified": "2018-05-10T09:39:41.000Z",
|
|
"pattern": "[file:hashes.MD5 = '20deff5786a4769b219c304965559043' AND file:hashes.SHA1 = 'dc6102418faedf4379bfc786acb216d5defe64f0' AND file:hashes.SHA256 = 'bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T09:39:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:40.000Z",
|
|
"modified": "2018-05-10T09:39:40.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-05-10T08:31:27",
|
|
"category": "Other",
|
|
"uuid": "c79e6e09-dd54-4cbc-875c-7abdb53c2f4a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/bab7e9f42df88902acb00fbdf3b4b5d8ffec2a1a7ad32eb5f2fb1dbf38f3167d/analysis/1525941087/",
|
|
"category": "External analysis",
|
|
"uuid": "68c1f245-9031-479f-a729-f8a227046e5b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/59",
|
|
"category": "Other",
|
|
"uuid": "63eae805-0aea-4d07-9ff4-8cef4a623a81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:44.000Z",
|
|
"modified": "2018-05-10T09:39:44.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a536f99aa4030efb5d44c0b4792f4e9b' AND file:hashes.SHA1 = '44e341d28d744e0b3d2fa1a8cc3481f184d155ff' AND file:hashes.SHA256 = '7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-05-10T09:39:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-05-10T09:39:42.000Z",
|
|
"modified": "2018-05-10T09:39:42.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-05-09T21:12:19",
|
|
"category": "Other",
|
|
"uuid": "37b71505-ff33-4199-a543-901564c40401"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7caac9c9fa954730665d63b692119ba5f14ee6c07cf11ffc60bca7b3d25ea109/analysis/1525900339/",
|
|
"category": "External analysis",
|
|
"uuid": "55484663-5402-4902-b741-1165e89e8e86"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "0/60",
|
|
"category": "Other",
|
|
"uuid": "cdb5cf8b-006d-4ea6-8921-136278f3eb35"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e0be4445-87d0-4b95-aae0-e1589790dce7",
|
|
"created": "2018-05-10T09:39:43.000Z",
|
|
"modified": "2018-05-10T09:39:43.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--dc6a8900-6a96-4f53-bdfd-0254abb3488c",
|
|
"target_ref": "x-misp-object--8d13fd99-2a7c-4017-9387-2567f59daf69"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6d06ff82-97a7-4a1a-bbec-859ce3376d7d",
|
|
"created": "2018-05-10T09:39:43.000Z",
|
|
"modified": "2018-05-10T09:39:43.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--b6b62156-63cf-4749-a53e-0fbf146c58cc",
|
|
"target_ref": "x-misp-object--18ba50c8-c137-4b81-a1e7-139dd14edb85"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9c7c3624-0ef6-44a7-96e8-315ab6f01b20",
|
|
"created": "2018-05-10T09:39:43.000Z",
|
|
"modified": "2018-05-10T09:39:43.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--45af68f9-c923-46f1-8109-faecfda308db",
|
|
"target_ref": "x-misp-object--59cf2b7f-07e3-4edc-a259-f0a20bb7385c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--1f8ef554-ff78-4b28-aaa6-ad0b2ddabed4",
|
|
"created": "2018-05-10T09:39:43.000Z",
|
|
"modified": "2018-05-10T09:39:43.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--7a02e5c6-e5da-45ec-a657-668dac4eb660",
|
|
"target_ref": "x-misp-object--de42e5e8-eaf8-46d1-8cd9-43918d19e250"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--818a8499-e570-4dbc-bd3b-3ef1b29c42e9",
|
|
"created": "2018-05-10T09:39:43.000Z",
|
|
"modified": "2018-05-10T09:39:43.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--4a3b47dc-bdfb-4938-a0d2-eb685c5f0159",
|
|
"target_ref": "x-misp-object--2ab174e4-96c0-478b-9f8a-a43c7f49341c"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |