misp-circl-feed/feeds/circl/misp/57ee6d8c-0650-4c8a-9dfa-4f31950d210f.json

571 lines
No EOL
23 KiB
JSON

{
"type": "bundle",
"id": "bundle--57ee6d8c-0650-4c8a-9dfa-4f31950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--57ee6d8c-0650-4c8a-9dfa-4f31950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"name": "Malspam 2016-09-30 (.wsf in .zip) - campaign: \"Parcel details\"",
"published": "2016-09-30T13:51:03Z",
"object_refs": [
"indicator--57ee6dad-290c-4123-8016-4cea950d210f",
"indicator--57ee6dad-a9d4-4132-a115-48e9950d210f",
"indicator--57ee6dad-5aac-461c-802c-477d950d210f",
"indicator--57ee6dae-9d28-44cc-9830-4145950d210f",
"indicator--57ee6dae-59b4-476d-8846-4e81950d210f",
"indicator--57ee6dae-a418-4f7e-8fdd-4164950d210f",
"indicator--57ee6dae-5318-4955-ad4d-4526950d210f",
"indicator--57ee6dae-79b0-42c8-aa35-4fad950d210f",
"indicator--57ee6daf-bf6c-4433-9dd7-44bd950d210f",
"indicator--57ee6daf-9788-4ce7-b4fd-469c950d210f",
"indicator--57ee6daf-bac4-40a2-8029-405f950d210f",
"indicator--57ee6daf-07e0-4e9b-9757-4264950d210f",
"indicator--57ee6daf-1d54-4a2a-aaa8-4dc2950d210f",
"indicator--57ee6db0-4814-4305-b92b-4530950d210f",
"indicator--57ee6db0-4000-4f2f-b351-4f04950d210f",
"indicator--57ee6db0-7d7c-4a67-a70e-449e950d210f",
"indicator--57ee6db0-a2c4-4fdf-a57a-419f950d210f",
"indicator--57ee6db1-8edc-4932-8b75-4740950d210f",
"indicator--57ee6db1-a7f0-4039-881f-4c90950d210f",
"indicator--57ee6db1-bca4-4371-b87b-4421950d210f",
"indicator--57ee6db1-78f4-4ec2-97cc-4090950d210f"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"circl:incident-classification=\"malware\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dad-290c-4123-8016-4cea950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:37.000Z",
"modified": "2016-09-30T13:50:37.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '103.6.196.150']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dad-a9d4-4132-a115-48e9950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:37.000Z",
"modified": "2016-09-30T13:50:37.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '107.180.50.231']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dad-5aac-461c-802c-477d950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:37.000Z",
"modified": "2016-09-30T13:50:37.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '190.147.38.2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dae-9d28-44cc-9830-4145950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:38.000Z",
"modified": "2016-09-30T13:50:38.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '23.254.128.73']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dae-59b4-476d-8846-4e81950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:38.000Z",
"modified": "2016-09-30T13:50:38.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '31.210.120.156']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dae-a418-4f7e-8fdd-4164950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:38.000Z",
"modified": "2016-09-30T13:50:38.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '66.117.4.26']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dae-5318-4955-ad4d-4526950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:38.000Z",
"modified": "2016-09-30T13:50:38.000Z",
"description": "download location",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.9.63.225']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6dae-79b0-42c8-aa35-4fad950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:38.000Z",
"modified": "2016-09-30T13:50:38.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'drugvacoa.net']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:38Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6daf-bf6c-4433-9dd7-44bd950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:39.000Z",
"modified": "2016-09-30T13:50:39.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'greenshootmedia.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6daf-9788-4ce7-b4fd-469c950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:39.000Z",
"modified": "2016-09-30T13:50:39.000Z",
"description": "download location",
"pattern": "[url:value = 'http://drugvacoa.net/6n00x']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6daf-bac4-40a2-8029-405f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:39.000Z",
"modified": "2016-09-30T13:50:39.000Z",
"description": "download location",
"pattern": "[url:value = 'http://greenshootmedia.com/w1zanty']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6daf-07e0-4e9b-9757-4264950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:39.000Z",
"modified": "2016-09-30T13:50:39.000Z",
"description": "download location",
"pattern": "[url:value = 'http://lust-vodka.com/fom7aof']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6daf-1d54-4a2a-aaa8-4dc2950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:39.000Z",
"modified": "2016-09-30T13:50:39.000Z",
"description": "download location",
"pattern": "[url:value = 'http://puchipuchivirus.com/vvkqo7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:39Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db0-4814-4305-b92b-4530950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:40.000Z",
"modified": "2016-09-30T13:50:40.000Z",
"description": "download location",
"pattern": "[url:value = 'http://resboiu.ro/fpcmb']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db0-4000-4f2f-b351-4f04950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:40.000Z",
"modified": "2016-09-30T13:50:40.000Z",
"description": "download location",
"pattern": "[url:value = 'http://room8008.com/g44ntci1']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db0-7d7c-4a67-a70e-449e950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:40.000Z",
"modified": "2016-09-30T13:50:40.000Z",
"description": "download location",
"pattern": "[url:value = 'http://unityquire.com/1nloic']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db0-a2c4-4fdf-a57a-419f950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:40.000Z",
"modified": "2016-09-30T13:50:40.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'lust-vodka.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:40Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db1-8edc-4932-8b75-4740950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'puchipuchivirus.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db1-a7f0-4039-881f-4c90950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'resboiu.ro']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db1-bca4-4371-b87b-4421950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'room8008.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--57ee6db1-78f4-4ec2-97cc-4090950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2016-09-30T13:50:41.000Z",
"modified": "2016-09-30T13:50:41.000Z",
"description": "download location",
"pattern": "[domain-name:value = 'unityquire.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2016-09-30T13:50:41Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}