adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5e2a9dc9-adb4-49bc-9be1-4304950d210f.json

277 lines
No EOL
12 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5e2a9dc9-adb4-49bc-9be1-4304950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:34:28.000Z",
"modified": "2020-01-24T08:34:28.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5e2a9dc9-adb4-49bc-9be1-4304950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:34:28.000Z",
"modified": "2020-01-24T08:34:28.000Z",
"name": "OSINT - First Node.js-based Ransomware : Nodera",
"published": "2020-01-24T08:34:40Z",
"object_refs": [
"indicator--5e2aaa52-d230-4bc6-ab9f-2090950d210f",
"indicator--5e2aaa54-d280-4e74-bd88-2090950d210f",
"observed-data--5e2aaadd-e758-49f9-825e-2091950d210f",
"url--5e2aaadd-e758-49f9-825e-2091950d210f",
"indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
"x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
"indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
"x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f",
"relationship--3e6a8a5c-ce91-44e2-ad86-74bced6fe363",
"relationship--7763908a-d358-4cad-a573-8cd7c10a88f8"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"misp-galaxy:ransomware=\"Nodera Ransomware\"",
"dnc:malware-type=\"Ransomware\"",
"enisa:nefarious-activity-abuse=\"ransomware\"",
"ecsirt:malicious-code=\"ransomware\"",
"malware_classification:malware-category=\"Ransomware\"",
"veris:action:malware:variety=\"Ransomware\"",
"Ransomware",
"ms-caro-malware:malware-type=\"Ransom\"",
"ms-caro-malware-full:malware-type=\"Ransom\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e2aaa52-d230-4bc6-ab9f-2090950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:26:58.000Z",
"modified": "2020-01-24T08:26:58.000Z",
"pattern": "[file:hashes.SHA256 = '7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-24T08:26:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5e2aaa54-d280-4e74-bd88-2090950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:27:00.000Z",
"modified": "2020-01-24T08:27:00.000Z",
"pattern": "[file:hashes.SHA256 = '53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-24T08:27:00Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5e2aaadd-e758-49f9-825e-2091950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:29:17.000Z",
"modified": "2020-01-24T08:29:17.000Z",
"first_observed": "2020-01-24T08:29:17Z",
"last_observed": "2020-01-24T08:29:17Z",
"number_observed": 1,
"object_refs": [
"url--5e2aaadd-e758-49f9-825e-2091950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5e2aaadd-e758-49f9-825e-2091950d210f",
"value": "https://blogs.quickheal.com/first-node-js-based-ransomware-nodera/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:27:51.000Z",
"modified": "2020-01-24T08:27:51.000Z",
"pattern": "[file:hashes.MD5 = '976b17845289d9f8a5ee1c8a9e9c4173' AND file:hashes.SHA1 = 'c458e4c32e3ebb1fca331ef235fe3f96e505e066' AND file:hashes.SHA256 = '53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-24T08:27:51Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:27:51.000Z",
"modified": "2020-01-24T08:27:51.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2020-01-24T07:09:56",
"category": "Other",
"uuid": "97ad26f4-976d-44ea-9c7e-9ce0894ba133"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/53a95c9126be8262afb0821da4d7137e6c8a4d9b363f91298249ca134d394bf4/analysis/1579849796/",
"category": "Payload delivery",
"uuid": "bac4b8ec-8e41-42ca-bf06-cf214c10ffa8"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "11/56",
"category": "Payload delivery",
"uuid": "30db4ce2-0d52-4e48-8df2-8afb47f8f6b9"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:27:52.000Z",
"modified": "2020-01-24T08:27:52.000Z",
"pattern": "[file:hashes.MD5 = 'e8cfee97467d4006257afdaabf945565' AND file:hashes.SHA1 = '7879bbaf9bd6de58a7b318d013cd479d4a24ffae' AND file:hashes.SHA256 = '7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2020-01-24T08:27:52Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2020-01-24T08:27:52.000Z",
"modified": "2020-01-24T08:27:52.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2020-01-24T05:46:08",
"category": "Other",
"uuid": "e384fb38-468a-4e7a-b1d3-e112b4037604"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/7265c1fb74eb9ea3cd98358475620ce54b9033421ba042957135bdefd078b366/analysis/1579844768/",
"category": "Payload delivery",
"uuid": "3a80a603-65cb-4fb0-91c1-15dbf8fc3e71"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "23/57",
"category": "Payload delivery",
"uuid": "c09bba97-5263-4b7d-8139-0b86b92333e0"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--3e6a8a5c-ce91-44e2-ad86-74bced6fe363",
"created": "2020-01-24T08:27:52.000Z",
"modified": "2020-01-24T08:27:52.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--5f8af945-8a3d-4504-b607-7ddfdf6deb75",
"target_ref": "x-misp-object--51ba9d61-5380-4585-b0c0-b7fe0bc36bc9"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--7763908a-d358-4cad-a573-8cd7c10a88f8",
"created": "2020-01-24T08:27:52.000Z",
"modified": "2020-01-24T08:27:52.000Z",
"relationship_type": "analysed-with",
"source_ref": "indicator--cc3072d2-9476-47dd-8aa5-820487dea369",
"target_ref": "x-misp-object--b9cfdf21-9bd5-4e25-8006-51f1643b713f"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink