443 lines
No EOL
26 KiB
JSON
443 lines
No EOL
26 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5e3be06f-d0a8-4ed9-abe9-46be950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:44.000Z",
|
|
"modified": "2020-02-06T09:51:44.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5e3be06f-d0a8-4ed9-abe9-46be950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:44.000Z",
|
|
"modified": "2020-02-06T09:51:44.000Z",
|
|
"name": "Warzone RAT",
|
|
"published": "2020-02-06T09:52:22Z",
|
|
"object_refs": [
|
|
"indicator--fbf11cfc-a457-eaf8-3dfb-6abe2df5f666",
|
|
"indicator--5513bd0d-2b40-401e-9367-bb4d3e39e502",
|
|
"indicator--205c7727-2319-4f00-af2a-997357604a0c",
|
|
"indicator--ecf2c227-969a-c8b9-6a3c-b4c3b1db748a",
|
|
"indicator--e7173efd-93b2-475b-8abc-60f140bcf25c",
|
|
"indicator--ca82ea25-3ba9-63c8-f056-984aa585384a",
|
|
"x-misp-object--5e3be071-1350-430b-9f34-4bbe950d210f",
|
|
"indicator--c53a3956-bd1c-48f9-817e-1805443e5903",
|
|
"x-misp-object--f9adf39d-f254-432d-a3c9-2229170df07f",
|
|
"indicator--33a3d10b-1db8-4ccb-9182-8afa3091d7b5",
|
|
"x-misp-object--9b5e1555-70e4-4ab9-9d15-9c275c4c246f",
|
|
"indicator--0756ce6a-a014-4acb-bad4-7ad09bffa51b",
|
|
"x-misp-object--acc5dfc6-cf65-45fa-a6a9-fb4330cc31f4",
|
|
"relationship--c44ccdb2-3792-4cc0-89ab-6b5572913d01",
|
|
"relationship--0f18f9b4-4d89-4aa3-8c29-fefb15134ef8",
|
|
"relationship--ffda1360-01bf-4c39-8d9c-a15c21412814"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT",
|
|
"osint:lifetime=\"perpetual\"",
|
|
"osint:certainty=\"50\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--fbf11cfc-a457-eaf8-3dfb-6abe2df5f666",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:23.000Z",
|
|
"modified": "2020-02-06T09:46:23.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '263433966d28f1e6e5f6ae389ca3694495dd8fcc08758ea113dddc45fe6b3741']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5513bd0d-2b40-401e-9367-bb4d3e39e502",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"pattern": "[url:value = 'warzonedns.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--205c7727-2319-4f00-af2a-997357604a0c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"pattern": "[url:value = 'warzone.pw']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--ecf2c227-969a-c8b9-6a3c-b4c3b1db748a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '531d967b9204291e70e3aab161a5b7f1001339311ece4f2eed8e52e91559c755']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e7173efd-93b2-475b-8abc-60f140bcf25c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"pattern": "[url:value = 'warzone.io']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--ca82ea25-3ba9-63c8-f056-984aa585384a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'a03764da06bbf52678d65500fa266609d45b972709b3213a8f83f52347524cf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5e3be071-1350-430b-9f34-4bbe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:46:25.000Z",
|
|
"modified": "2020-02-06T09:46:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"original-imported-file\"",
|
|
"misp:meta-category=\"file\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "attachment",
|
|
"object_relation": "imported-sample",
|
|
"value": "xfe-collection_44b31b168cb53262c1b08f1b06e0a1f9.json",
|
|
"category": "External analysis",
|
|
"uuid": "5e3be071-ddbc-4cb6-a049-420e950d210f",
|
|
"data": "eyJzcGVjX3ZlcnNpb24iOiIyLjAiLCJ0eXBlIjoiYnVuZGxlIiwib2JqZWN0cyI6W3siaWQiOiJpbmRpY2F0b3ItLWNhODJlYTI1LTNiYTktNjNjOC1mMDU2LTk4NGFhNTg1Mzg0YSIsInR5cGUiOiJpbmRpY2F0b3IiLCJjcmVhdGVkIjoiMjAyMC0wMi0wNlQwOTo0NTo1OC4yNDFaIiwibW9kaWZpZWQiOiIyMDIwLTAyLTA2VDA5OjQ1OjU4LjI0MVoiLCJsYWJlbHMiOlsieGZlLW1hbHdhcmUtcmlzay1oaWdoIl0sIm5hbWUiOiJGaWxlIGhhc2ggaW5kaWNhdG9yIGZvciBzaGEyNTYgaGFzaCBhMDM3NjRkYTA2YmJmNTI2NzhkNjU1MDBmYTI2NjYwOWQ0NWI5NzI3MDliMzIxM2E4ZjgzZjUyMzQ3NTI0Y2YyIiwiZGVzY3JpcHRpb24iOiJGaWxlIGhhc2ggaW5kaWNhdG9yIGZvciBzaGEyNTYgaGFzaCBhMDM3NjRkYTA2YmJmNTI2NzhkNjU1MDBmYTI2NjYwOWQ0NWI5NzI3MDliMzIxM2E4ZjgzZjUyMzQ3NTI0Y2YyIiwicGF0dGVybiI6IlsgZmlsZTpoYXNoZXMuJ1NIQS0yNTYnID0gJ2EwMzc2NGRhMDZiYmY1MjY3OGQ2NTUwMGZhMjY2NjA5ZDQ1Yjk3MjcwOWIzMjEzYThmODNmNTIzNDc1MjRjZjInIF0iLCJ2YWxpZF9mcm9tIjoiMjAyMC0wMi0wNlQwOTo0NTo1OC4yNDFaIn0seyJpZCI6ImluZGljYXRvci0tZWNmMmMyMjctOTY5YS1jOGI5LTZhM2MtYjRjM2IxZGI3NDhhIiwidHlwZSI6ImluZGljYXRvciIsImNyZWF0ZWQiOiIyMDIwLTAyLTA2VDA5OjQ1OjU4LjI0MloiLCJtb2RpZmllZCI6IjIwMjAtMDItMDZUMDk6NDU6NTguMjQyWiIsImxhYmVscyI6WyJ4ZmUtbWFsd2FyZS1yaXNrLWhpZ2giXSwibmFtZSI6IkZpbGUgaGFzaCBpbmRpY2F0b3IgZm9yIHNoYTI1NiBoYXNoIDUzMWQ5NjdiOTIwNDI5MWU3MGUzYWFiMTYxYTViN2YxMDAxMzM5MzExZWNlNGYyZWVkOGU1MmU5MTU1OWM3NTUiLCJkZXNjcmlwdGlvbiI6IkZpbGUgaGFzaCBpbmRpY2F0b3IgZm9yIHNoYTI1NiBoYXNoIDUzMWQ5NjdiOTIwNDI5MWU3MGUzYWFiMTYxYTViN2YxMDAxMzM5MzExZWNlNGYyZWVkOGU1MmU5MTU1OWM3NTUiLCJwYXR0ZXJuIjoiWyBmaWxlOmhhc2hlcy4nU0hBLTI1NicgPSAnNTMxZDk2N2I5MjA0MjkxZTcwZTNhYWIxNjFhNWI3ZjEwMDEzMzkzMTFlY2U0ZjJlZWQ4ZTUyZTkxNTU5Yzc1NScgXSIsInZhbGlkX2Zyb20iOiIyMDIwLTAyLTA2VDA5OjQ1OjU4LjI0MloifSx7ImlkIjoiaW5kaWNhdG9yLS1lNzE3M2VmZC05M2IyLTQ3NWItOGFiYy02MGYxNDBiY2YyNWMiLCJ0eXBlIjoiaW5kaWNhdG9yIiwiY3JlYXRlZCI6IjIwMjAtMDItMDRUMjA6MTM6NDkuNTU0WiIsIm1vZGlmaWVkIjoiMjAyMC0wMi0wNFQyMDoxMzo0OS41NTRaIiwibGFiZWxzIjpbImJlbmlnbiIsInhmZS10aHJlYXQtc2NvcmUtdW5kZWZpbmVkIl0sIm5hbWUiOiJVUkwgUmVwb3J0IGZvciB3YXJ6b25lLmlvIiwiZGVzY3JpcHRpb24iOiIiLCJwYXR0ZXJuIjoiWyB1cmw6dmFsdWUgPSAnd2Fyem9uZS5pbycgXSIsInZhbGlkX2Zyb20iOiIyMDIwLTAyLTA0VDIwOjEzOjQ5LjU1NFoifSx7ImlkIjoiaW5kaWNhdG9yLS0yMDVjNzcyNy0yMzE5LTRmMDAtYWYyYS05OTczNTc2MDRhMGMiLCJ0eXBlIjoiaW5kaWNhdG9yIiwiY3JlYXRlZCI6IjIwMjAtMDItMDRUMjA6MTM6NDkuMzM0WiIsIm1vZGlmaWVkIjoiMjAyMC0wMi0wNFQyMDoxMzo0OS4zMzRaIiwibGFiZWxzIjpbImJlbmlnbiIsInhmZS10aHJlYXQtc2NvcmUtMSJdLCJuYW1lIjoiVVJMIFJlcG9ydCBmb3Igd2Fyem9uZS5wdyIsImRlc2NyaXB0aW9uIjoiQ2F0ZWdvcnk6IEdlbmVyYWwgQnVzaW5lc3NcbiAgICAgIERlc2NyaXB0aW9uOiBUaGlzIGNhdGVnb3J5IGluY2x1ZGVzIFdlYiBzaXRlcyBvZiBpbmR1c3RyeSwgYnVzaW5lc3MsIGVjb25vbXkgYW5kIHN1cHBseSBvZiBzZXJ2aWNlcy4iLCJwYXR0ZXJuIjoiWyB1cmw6dmFsdWUgPSAnd2Fyem9uZS5wdycgXSIsInZhbGlkX2Zyb20iOiIyMDIwLTAyLTA0VDIwOjEzOjQ5LjMzNFoifSx7ImlkIjoiaW5kaWNhdG9yLS01NTEzYmQwZC0yYjQwLTQwMWUtOTM2Ny1iYjRkM2UzOWU1MDIiLCJ0eXBlIjoiaW5kaWNhdG9yIiwiY3JlYXRlZCI6IjIwMjAtMDItMDRUMjA6MTM6NDkuMjU4WiIsIm1vZGlmaWVkIjoiMjAyMC0wMi0wNFQyMDoxMzo0OS4yNThaIiwibGFiZWxzIjpbImJlbmlnbiIsInhmZS10aHJlYXQtc2NvcmUtMSJdLCJuYW1lIjoiVVJMIFJlcG9ydCBmb3Igd2Fyem9uZWRucy5jb20iLCJkZXNjcmlwdGlvbiI6IkNhdGVnb3J5OiBHZW5lcmFsIEJ1c2luZXNzXG4gICAgICBEZXNjcmlwdGlvbjogVGhpcyBjYXRlZ29yeSBpbmNsdWRlcyBXZWIgc2l0ZXMgb2YgaW5kdXN0cnksIGJ1c2luZXNzLCBlY29ub215IGFuZCBzdXBwbHkgb2Ygc2VydmljZXMuIiwicGF0dGVybiI6IlsgdXJsOnZhbHVlID0gJ3dhcnpvbmVkbnMuY29tJyBdIiwidmFsaWRfZnJvbSI6IjIwMjAtMDItMDRUMjA6MTM6NDkuMjU4WiJ9LHsiaWQiOiJpbmRpY2F0b3ItLWZiZjExY2ZjLWE0NTctZWFmOC0zZGZiLTZhYmUyZGY1ZjY2NiIsInR5cGUiOiJpbmRpY2F0b3IiLCJjcmVhdGVkIjoiMjAyMC0wMi0wNlQwOTo0NTo1OC4yNDJaIiwibW9kaWZpZWQiOiIyMDIwLTAyLTA2VDA5OjQ1OjU4LjI0MloiLCJsYWJlbHMiOlsieGZlLW1hbHdhcmUtcmlzay1oaWdoIl0sIm5hbWUiOiJGaWxlIGhhc2ggaW5kaWNhdG9yIGZvciBzaGEyNTYgaGFzaCAyNjM0MzM5NjZkMjhmMWU2ZTVmNmFlMzg5Y2EzNjk0NDk1ZGQ4ZmNjMDg3NThlYTExM2RkZGM0NWZlNmIzNzQxIiwiZGVzY3JpcHRpb24iOiJGaWxlIGhhc2ggaW5kaWNhdG9yIGZvciBzaGEyNTYgaGFzaCAyNjM0MzM5NjZkMjhmMWU2ZTVmNmFlMzg5Y2EzNjk0NDk1ZGQ4ZmNjMDg3NThlYTExM2RkZGM0NWZlNmIzNzQxIiwicGF0dGVybiI6IlsgZmlsZTpoYXNoZXMuJ1NIQS0yNTYnID0gJzI2MzQzMzk2NmQyOGYxZTZlNWY2YWUzODljYTM2OTQ0OTVkZDhmY2MwODc1OGVhMTEzZGRkYzQ1ZmU2YjM3NDEnIF0iLCJ2YWxpZF9mcm9tIjoiMjAyMC0wMi0wNlQwOTo0NTo1OC4yNDJaIn1dLCJjdXN0b21fb2JqZWN0cyI6W3sidHlwZSI6IngteGZlLWNvbGxlY3Rpb24iLCJpZCI6IngteGZlLWNvbGxlY3Rpb24tLTQ0YjMxYjE2LThjYjUtMzI2Mi1jMWIwLThmMWIwNmUwYTFmOSIsImNvbGxlY3Rpb25UaXRsZSI6IldhcnpvbmUgUkFUIiwiY29sbGVjdGlvbldpa2lDb250ZW50IjoiU3VtbWFyeVxuV2Fyem9uZSBpcyBhIFJBVCBzb2xkIHB1YmxpY2x5IGFzIHBhcnQgb2YgYSBNYWx3YXJlLWFzLWEtU2VydmljZSAoTWFhUykgZnJhbWV3b3JrIGJ5IGl0cyBhdXRob3JzLiBDaGVjayBQb2ludCBoYXMgcHVibGlzaGVkIGFuIGFuYWx5c2lzIG9mIHRoZSBXYXJ6b25lIFJBVCBhbmQgaXRzIGJ1aWxkZXIuIFxuVGhyZWF0IFR5cGVcbk1hbHdhcmUsIFJBVFxuT3ZlcnZpZXdcbkluIHRoZWlyIGJsb2cgcG9zdCBvbiB0aGUgV2Fyem9uZSBSQVQsIENoZWNrIFBvaW50IHJlc2VhcmNoZXJzIGRpc2N1c3MgdGhlIHNhbGUgb2YgdGhlIG1hbHdhcmUsIGl0cyBvcGVyYXRpb24gb24gYW4gaW5mZWN0ZWQgbWFjaGluZSwgYW5kIHRoZSBidWlsZGVyL21hbmFnZXIgdXNlZCBieSBwdXJjaGFzZXJzIG9mIHRoZSBSQVQuIFRoZSBXYXJ6b25lIFJBVCBpcyBhZHZlcnRpc2VkIG9uIGl0cyBvd24gd2Vic2l0ZSBhbmQgc29sZCB1c2luZyBhIHN1YnNjcmlwdGlvbiBtb2RlbCB3aGVyZSB0aGUgbW9zdCBleHBlbnNpdmUgc3Vic2NyaXB0aW9ucyBwcm92aWRlIGxvbmdlciB0aW1lIHBlcmlvZHMgYWRkaXRpb25hbCBmZWF0dXJlcywgc3VjaCBhcyBwcmVtaXVtIERETlMsIGN1c3RvbWVyIHN1cHBvcnQsIGFuZCByb290a2l0cy4gVGhlIGF1dGhvcnMgYWxzbyBzZWxsIGNyeXB0b3JzIGFuZCBleHBsb2l0IGJ1aWxkZXJzIHRvIGJlIHVzZWQgaW4gY29uanVuY3Rpb24gd2l0aCB0aGUgUkFUIGZvciBhbiBhZGRpdGlvbmFsIGNvc3QuIEFzIG9wcG9zZWQgdG8gbWFueSBzaW1pbGFyIE1hbHdhcmUtYXMtYS1TZXJ2aWNlIChNYWFTKSBSQVRzLCB3aGljaCBhcmUgd3JpdHRlbiBpbiAuTkVULCB0aGUgV2Fyem9uZSBSQVQgaXMgd3JpdHRlbiBpbiBDKysgYW5kIHRodXMgY29tcGF0aWJsZSB3aXRoIGFsbCBXaW5kb3dzIHJlbGVhc2VzLiBUaGUgcmVzZWFyY2hlcnMgaW5jbHVkZSBhIGRlZXAgZGl2ZSBpbnRvIHRoZSBVQUMgYnlwYXNzIG1ldGhvZHMgdXNlZCBieSB0aGUgUkFULCB3aGljaCBkaWZmZXIgZGVwZW5kaW5nIG9uIHdoZXRoZXIgV2luZG93cyAxMCBvciBhbiBvbGRlciB2ZXJzaW9uIGlzIHJ1bm5pbmcgb24gdGhlIHN5c3RlbS4gQWZ0ZXIgcHJpdmlsZWdlcyBhcmUgZXNjYWxhdGVkIHZpYSB0aGUgVUFDIGJ5cGFzcyB0ZWNobmlxdWVzLCBwZXJzaXN0ZW5jZSBpcyBlc3RhYmxpc2hlZCB1c2luZyBSZWdpc3RyeSBSdW4ga2V5cy4gQ29tbXVuaWNhdGlvbiB3aXRoIGl0cyBDMiBpcyB0aGVuIGluaXRpYXRlZCBvdmVyIFRDUCBwb3J0IDUyMDAuIFRoZSBwYXlsb2FkIGlzIFJDNC1lbmNyeXB0ZWQgaW4gbW9zdCB2ZXJzaW9ucyBvZiB0aGUgV2Fyem9uZSBSQVQuIEFmdGVyIHNlbmRpbmcgdmFyaW91cyBzeXN0ZW0gaW5mb3JtYXRpb24gYmFjayB0byB0aGUgQzIgc2VydmVyLCBzdWNoIGFzIFBDIG5hbWUsIFJBTSBhbmQgQ1BVIHN0YXRzLCBhbmQgdGhlIE9TIHZlcnNpb24sIHRoZSBtYWx3YXJlIHdhaXRzIHRvIHJlY2VpdmUgY29tbWFuZHMuIEF2YWlsYWJsZSBjb21tYW5kcyBpbmNsdWRlIHRob3NlIGFzc29jaWF0ZWQgd2l0aCByZW1vdGUgc2hlbGwsIFJEUCwgb3IgVk5DIGFjY2VzcywgdGFzayBtYW5hZ2VtZW50LCBmaWxlIG9wZXJhdGlvbnMsIGtleWxvZ2dpbmcsIGFuZCBtb3JlLiBJZiBhcHBsaWNhYmxlLCB0aGUgb2J0YWluZWQgZGF0YSBpcyByZXR1cm5lZCB0byB0aGUgQzIgc2VydmVyLiBUaGUgcmVzZWFyY2hlcnMgYWxzbyBhbmFseXplZCBhIHNhbXBsZSBvZiB0aGUgYWRtaW5pc3RyYXRpb24gcGFuZWwgYW5kIGJ1aWxkZXIgdXNlZCBieSBwdXJjaGFzZXJzIG9mIHRoZSBSQVQuIEZyb20gdGhpcyBwYW5lbCwgdGhlIGJ1eWVyIGNhbiBlYXNpbHkgcGVyZm9ybSBhY3Rpb25zIGFnYWluc3QgYW55IHN1Y2Nlc3NmdWwgaW5mZWN0ZWQgaG9zdHMuIEZvciBtb3JlIGluZm9ybWF0aW9uLCBzZWUgdGhlIENoZWNrIFBvaW50IGFydGljbGUgaW4gdGhlIFJlZmVyZW5jZSBzZWN0aW9uLlxuSW5kaWNhdG9ycyBvZiBDb21wcm9taXNlXG5TSEEyNTZcbiA1MzFkOTY3YjkyMDQyOTFlNzBlM2FhYjE2MWE1YjdmMTAwMTMzOTMxMWVjZTRmMmVlZDhlNTJlOTE1NTljNzU1IFxuIGEwMzc2NGRhMDZiYmY1MjY3OGQ2NTUwMGZhMjY2NjA5ZDQ1Yjk3MjcwOWIzMjEzYThmODNmNTIzNDc1MjRjZjIgXG4gMjYzNDMzOTY2ZDI4ZjFlNmU1ZjZhZTM4OWNhMzY5NDQ5NWRkOGZjYzA4NzU4ZWExMTNkZGRjNDVmZTZiMzc0MSBcbkRvbWFpbnNcbiB3YXJ6b25lZG5zLmNvbSBcbiB3YXJ6b25lLnB3IFxuIHdhcnpvbmUuaW8gXG5SZWNvbW1lbmRhdGlvbnNcbkVuc3VyZSBhbnRpLXZpcnVzIHNvZnR3YXJlIGFuZCBhc3NvY2lhdGVkIGZpbGVzIGFyZSB1cCB0byBkYXRlLlxuU2VhcmNoIGZvciBleGlzdGluZyBzaWducyBvZiB0aGUgaW5kaWNhdGVkIElPQ3MgaW4geW91ciBlbnZpcm9ubWVudC5cbkJsb2NrIGFsbCBVUkwgYW5kIElQIGJhc2VkIElvQ3MgYXQgdGhlIGZpcmV3YWxsLCBJRFMsIHdlYiBnYXRld2F5cywgcm91dGVycyBvciBvdGhlciBwZXJpbWV0ZXItYmFzZWQgZGV2aWNlcy5cbktlZXAgYXBwbGljYXRpb25zIGFuZCBvcGVyYXRpbmcgc3lzdGVtcyBydW5uaW5nIGF0IHRoZSBjdXJyZW50IHJlbGVhc2VkIHBhdGNoIGxldmVsLlxuQWx3YXlzIGJlIHN1c3BpY2lvdXMgb2YgdW5zb2xpY2l0ZWQgZW1haWxzLlxuUmVmZXJlbmNlXG5odHRwczovL3Jlc2VhcmNoLmNoZWNrcG9pbnQuY29tLzIwMjAvd2Fyem9uZS1iZWhpbmQtdGhlLWVuZW15LWxpbmVzLyAiLCJjb2xsZWN0aW9uSWQiOiI0NGIzMWIxNjhjYjUzMjYyYzFiMDhmMWIwNmUwYTFmOSIsIm93bmVyIjoiMjAyMC0wMi0wNVQxNDo0MjoxNy44ODZaIiwidGFncyI6W10sInRscCI6IiIsImNyZWF0ZWQiOiIyMDIwLTAyLTA2VDA5OjQ1OjU4LjI2OFoiLCJtb2RpZmllZCI6IjIwMjAtMDItMDZUMDk6NDU6NTguMjY4WiJ9XSwiaWQiOiJidW5kbGUtLWEwNTgxYWU5LTBmMDQtNGMzNy05YTgwLTE0Mjc2OWZhNWZjNiJ9"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "format",
|
|
"value": "STIX 2.0",
|
|
"category": "Other",
|
|
"uuid": "5e3be071-4b10-40f0-b3e8-40f3950d210f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "file",
|
|
"x_misp_name": "original-imported-file"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c53a3956-bd1c-48f9-817e-1805443e5903",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:50:41.000Z",
|
|
"modified": "2020-02-06T09:50:41.000Z",
|
|
"pattern": "[file:hashes.MD5 = '16ba8719479baaaf2649690a13eb1e8e' AND file:hashes.SHA1 = '92caa2eb703d011755ead3ab9073b319a077d1a7' AND file:hashes.SHA256 = '263433966d28f1e6e5f6ae389ca3694495dd8fcc08758ea113dddc45fe6b3741']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:50:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f9adf39d-f254-432d-a3c9-2229170df07f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:19.000Z",
|
|
"modified": "2020-02-06T09:51:19.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2020-02-06T08:45:24",
|
|
"category": "Other",
|
|
"uuid": "61927374-e7d4-4bdc-ba0a-4537421dac4f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/263433966d28f1e6e5f6ae389ca3694495dd8fcc08758ea113dddc45fe6b3741/analysis/1580978724/",
|
|
"category": "Payload delivery",
|
|
"uuid": "70aec802-ee6a-470e-9815-7144ef416d99"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "59/71",
|
|
"category": "Payload delivery",
|
|
"uuid": "991907ba-f62a-4939-9d6d-288dbff24416"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--33a3d10b-1db8-4ccb-9182-8afa3091d7b5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:31.000Z",
|
|
"modified": "2020-02-06T09:51:31.000Z",
|
|
"pattern": "[file:hashes.MD5 = '08e869b11b70f084263bf01e730b1650' AND file:hashes.SHA1 = 'bbf009d679c218d9856cb9c0b14f38b43f5b75c0' AND file:hashes.SHA256 = 'a03764da06bbf52678d65500fa266609d45b972709b3213a8f83f52347524cf2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:51:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--9b5e1555-70e4-4ab9-9d15-9c275c4c246f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:43.000Z",
|
|
"modified": "2020-02-06T09:51:43.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2019-07-07T19:20:05",
|
|
"category": "Other",
|
|
"uuid": "33192d6a-2439-4ce0-a3ef-1cae0a9fa721"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a03764da06bbf52678d65500fa266609d45b972709b3213a8f83f52347524cf2/analysis/1562527205/",
|
|
"category": "Payload delivery",
|
|
"uuid": "b7e155b1-560f-47e5-ba88-fdd01594e224"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "56/72",
|
|
"category": "Payload delivery",
|
|
"uuid": "6f67e866-aaa0-4cbe-bd20-ae533def40ac"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--0756ce6a-a014-4acb-bad4-7ad09bffa51b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:44.000Z",
|
|
"modified": "2020-02-06T09:51:44.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd93bc04fd77f7762aaadffc707c5d3ae' AND file:hashes.SHA1 = 'a1bc0cbd855222231cd06682444dbafd3553ee13' AND file:hashes.SHA256 = '531d967b9204291e70e3aab161a5b7f1001339311ece4f2eed8e52e91559c755']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2020-02-06T09:51:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--acc5dfc6-cf65-45fa-a6a9-fb4330cc31f4",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2020-02-06T09:51:44.000Z",
|
|
"modified": "2020-02-06T09:51:44.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2020-02-06T08:25:33",
|
|
"category": "Other",
|
|
"uuid": "3be90cad-ccff-414e-ace1-cd894f097b97"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/531d967b9204291e70e3aab161a5b7f1001339311ece4f2eed8e52e91559c755/analysis/1580977533/",
|
|
"category": "Payload delivery",
|
|
"uuid": "ea078951-7b95-4c1d-9b46-4726caee60e1"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "58/69",
|
|
"category": "Payload delivery",
|
|
"uuid": "90a6caef-8a54-41f3-8359-8b6715df251a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c44ccdb2-3792-4cc0-89ab-6b5572913d01",
|
|
"created": "2020-02-06T09:51:44.000Z",
|
|
"modified": "2020-02-06T09:51:44.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--c53a3956-bd1c-48f9-817e-1805443e5903",
|
|
"target_ref": "x-misp-object--f9adf39d-f254-432d-a3c9-2229170df07f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--0f18f9b4-4d89-4aa3-8c29-fefb15134ef8",
|
|
"created": "2020-02-06T09:51:45.000Z",
|
|
"modified": "2020-02-06T09:51:45.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--33a3d10b-1db8-4ccb-9182-8afa3091d7b5",
|
|
"target_ref": "x-misp-object--9b5e1555-70e4-4ab9-9d15-9c275c4c246f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ffda1360-01bf-4c39-8d9c-a15c21412814",
|
|
"created": "2020-02-06T09:51:45.000Z",
|
|
"modified": "2020-02-06T09:51:45.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--0756ce6a-a014-4acb-bad4-7ad09bffa51b",
|
|
"target_ref": "x-misp-object--acc5dfc6-cf65-45fa-a6a9-fb4330cc31f4"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |