11956 lines
No EOL
520 KiB
JSON
11956 lines
No EOL
520 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5813ad13-c2fc-427d-b284-44cd02de0b81",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:04.000Z",
|
|
"modified": "2016-10-28T20:02:04.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5813ad13-c2fc-427d-b284-44cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:04.000Z",
|
|
"modified": "2016-10-28T20:02:04.000Z",
|
|
"name": "OSINT - Octopus-Rex. Evolution of a multi task Botnet",
|
|
"published": "2016-10-28T20:06:21Z",
|
|
"object_refs": [
|
|
"observed-data--5813ad55-a024-44f0-afb5-4c4d02de0b81",
|
|
"url--5813ad55-a024-44f0-afb5-4c4d02de0b81",
|
|
"x-misp-attribute--5813ad6d-5c50-4601-9deb-4a9002de0b81",
|
|
"indicator--5813adbd-4df4-47cc-93c5-488202de0b81",
|
|
"indicator--5813adbd-9f68-4078-8205-4e3502de0b81",
|
|
"indicator--5813adbe-48c8-4ef6-b2ad-489002de0b81",
|
|
"indicator--5813adbe-36a8-4c53-8fa2-4ad202de0b81",
|
|
"indicator--5813adbe-316c-4e9d-b576-485002de0b81",
|
|
"indicator--5813adbe-e9dc-4f53-a832-4b8802de0b81",
|
|
"indicator--5813adbf-e944-4d5c-aaa7-408c02de0b81",
|
|
"indicator--5813adbf-2964-4b6e-ac70-434702de0b81",
|
|
"indicator--5813adbf-30d4-4a1f-8a56-435402de0b81",
|
|
"indicator--5813adbf-f960-442e-95b2-4e6f02de0b81",
|
|
"indicator--5813adc0-9cbc-4869-8566-47a602de0b81",
|
|
"indicator--5813adc0-42c0-4fb7-834e-4bbc02de0b81",
|
|
"indicator--5813adc1-b780-4507-9187-494f02de0b81",
|
|
"indicator--5813adc1-eea8-4f7c-a9a6-4b7d02de0b81",
|
|
"indicator--5813adc2-7a90-4a57-93a0-4c2202de0b81",
|
|
"indicator--5813adc2-6f10-4ba7-8e7e-4f9602de0b81",
|
|
"indicator--5813adc3-de1c-4cad-9e7f-411202de0b81",
|
|
"indicator--5813adc3-b580-4ec7-b439-4bf102de0b81",
|
|
"indicator--5813adc4-8754-40a6-8d9f-40cb02de0b81",
|
|
"indicator--5813adc4-fcec-465b-8e36-486202de0b81",
|
|
"indicator--5813adc5-d21c-42f2-8788-493402de0b81",
|
|
"indicator--5813adc6-4538-4c9e-a748-42c802de0b81",
|
|
"indicator--5813adc6-becc-4ef4-8714-447f02de0b81",
|
|
"indicator--5813adc7-c1cc-4f8d-b809-4a9c02de0b81",
|
|
"indicator--5813adc7-e4cc-40b9-8a7f-4bdc02de0b81",
|
|
"indicator--5813adc8-c0d4-4e65-8e41-4ad502de0b81",
|
|
"indicator--5813adc8-972c-47bc-b4b1-450802de0b81",
|
|
"indicator--5813adc9-9aa0-4536-bc3b-479002de0b81",
|
|
"indicator--5813adc9-5b00-41d5-a0dc-4ca102de0b81",
|
|
"indicator--5813adca-1f64-41cd-bbc4-4c4b02de0b81",
|
|
"indicator--5813adca-ba28-4a4b-81d5-4a8e02de0b81",
|
|
"indicator--5813adcb-cfb8-4845-af37-48ec02de0b81",
|
|
"indicator--5813adcb-6e60-4f92-90d3-41dc02de0b81",
|
|
"indicator--5813adcc-5ac4-4c7e-8988-42b002de0b81",
|
|
"indicator--5813adcd-ad84-44cc-a15b-483302de0b81",
|
|
"indicator--5813adcd-4914-4a77-ac65-427f02de0b81",
|
|
"indicator--5813adce-497c-48aa-9d45-4d5f02de0b81",
|
|
"indicator--5813adce-f0dc-4162-95e5-4da502de0b81",
|
|
"indicator--5813adcf-01ac-432f-813a-45c702de0b81",
|
|
"indicator--5813add0-bc30-4bb8-9dcf-453f02de0b81",
|
|
"indicator--5813add0-b25c-4235-ad1a-443402de0b81",
|
|
"indicator--5813add1-7600-406c-a3e3-45b202de0b81",
|
|
"indicator--5813add1-8ab8-4250-91b9-4a3302de0b81",
|
|
"indicator--5813add2-734c-4ed1-9c4e-47e202de0b81",
|
|
"indicator--5813add3-9e74-4971-acf4-41d202de0b81",
|
|
"indicator--5813add3-9d70-4c17-ade9-462302de0b81",
|
|
"indicator--5813add4-533c-4f64-a044-436902de0b81",
|
|
"indicator--5813add5-64b0-49c6-b678-46a002de0b81",
|
|
"indicator--5813add5-82b4-49bb-b11a-404502de0b81",
|
|
"indicator--5813add6-fe70-4395-a94b-47be02de0b81",
|
|
"indicator--5813add6-1fa8-4775-b0ab-4bf702de0b81",
|
|
"indicator--5813add7-1b20-42cf-86e9-409902de0b81",
|
|
"indicator--5813add8-1e84-4bdc-96f8-412b02de0b81",
|
|
"indicator--5813add8-95a0-499b-a3a3-41bb02de0b81",
|
|
"indicator--5813add9-09f8-4dff-b9e5-408302de0b81",
|
|
"indicator--5813adda-c1dc-494e-85ac-4c2e02de0b81",
|
|
"indicator--5813adda-4740-4ef6-b7ad-48f402de0b81",
|
|
"indicator--5813addb-14f4-4af9-9d69-4daa02de0b81",
|
|
"indicator--5813addb-a318-4d66-a2aa-40a302de0b81",
|
|
"indicator--5813addc-38f0-41fe-b8fd-4f6b02de0b81",
|
|
"indicator--5813addc-8d1c-4667-b3a6-48db02de0b81",
|
|
"indicator--5813addd-677c-4f95-ae18-47d402de0b81",
|
|
"indicator--5813adde-b340-4ec2-b475-4ee102de0b81",
|
|
"indicator--5813adde-e698-4f3b-b1e8-444d02de0b81",
|
|
"indicator--5813addf-db14-4314-86c4-465502de0b81",
|
|
"indicator--5813addf-142c-41b1-bc1d-4eb802de0b81",
|
|
"indicator--5813ade0-65fc-41ce-ad4e-45b502de0b81",
|
|
"indicator--5813ade1-4dd4-41d7-a3b9-4b6202de0b81",
|
|
"indicator--5813ade1-5688-48ed-9ece-4c0d02de0b81",
|
|
"indicator--5813ade2-4d40-492c-b404-422102de0b81",
|
|
"indicator--5813ade2-7d1c-46d8-851b-4e0302de0b81",
|
|
"indicator--5813ade3-4a88-4352-8b18-4e6002de0b81",
|
|
"indicator--5813ade4-af3c-4f51-bc5c-458202de0b81",
|
|
"indicator--5813ade4-1ed8-46c5-8bf4-490d02de0b81",
|
|
"indicator--5813ade5-9f58-42c7-8dd4-433c02de0b81",
|
|
"indicator--5813ade6-161c-4b5f-9b18-484102de0b81",
|
|
"indicator--5813ade6-3d20-44f0-9f56-438b02de0b81",
|
|
"indicator--5813ade7-0f64-46de-9602-4f0202de0b81",
|
|
"indicator--5813ade7-b280-4e81-b5df-467902de0b81",
|
|
"indicator--5813ade8-99d8-445f-babd-4c7c02de0b81",
|
|
"indicator--5813ade9-6a64-46e7-829a-4d1802de0b81",
|
|
"indicator--5813ade9-1ec4-4d2e-ad07-42ff02de0b81",
|
|
"indicator--5813adea-3f20-4bb1-a81e-410c02de0b81",
|
|
"indicator--5813adea-83c0-49cc-a2b8-4d8802de0b81",
|
|
"indicator--5813adeb-b1bc-4efa-8991-4fc602de0b81",
|
|
"indicator--5813adec-e780-4271-adde-497e02de0b81",
|
|
"indicator--5813adec-a918-42ee-8d5c-444902de0b81",
|
|
"indicator--5813aded-b7e4-4398-87ee-4e4202de0b81",
|
|
"indicator--5813aded-28f0-4c90-b5f3-46b602de0b81",
|
|
"indicator--5813adee-5b30-4730-b745-45cc02de0b81",
|
|
"indicator--5813adef-cb40-46f4-9e53-445002de0b81",
|
|
"indicator--5813adef-37e8-4267-9016-49d902de0b81",
|
|
"indicator--5813adf0-9c40-40f6-a14d-430a02de0b81",
|
|
"indicator--5813adf0-2a08-4075-8ad6-465a02de0b81",
|
|
"indicator--5813adf1-b894-4532-9664-4f9402de0b81",
|
|
"indicator--5813adf2-7f80-4f35-a397-4a5402de0b81",
|
|
"indicator--5813adf2-283c-45d4-89fa-474002de0b81",
|
|
"indicator--5813adf3-ef44-4052-bf4c-414702de0b81",
|
|
"indicator--5813adf4-3034-41f9-a4da-40db02de0b81",
|
|
"indicator--5813adf4-eccc-45a8-93de-432002de0b81",
|
|
"indicator--5813adf5-04f8-4183-9b19-443802de0b81",
|
|
"indicator--5813adf5-b4b4-49dd-9bfa-47f302de0b81",
|
|
"indicator--5813adf6-b12c-4002-ba4b-489a02de0b81",
|
|
"indicator--5813adf7-bf0c-4f39-8483-4c0f02de0b81",
|
|
"indicator--5813adf7-dce8-4e82-bc96-4b1b02de0b81",
|
|
"indicator--5813adf8-e488-4b31-8595-4f8e02de0b81",
|
|
"indicator--5813adf9-7dc8-40ae-9a8a-4e0402de0b81",
|
|
"indicator--5813adf9-98f0-4c42-ba5c-407602de0b81",
|
|
"indicator--5813adfa-ad3c-4f7f-8e66-4a2502de0b81",
|
|
"indicator--5813adfa-9060-4b8c-a1cd-473802de0b81",
|
|
"indicator--5813adfb-79d8-408f-b23d-450702de0b81",
|
|
"indicator--5813adfb-72dc-4deb-82ad-494702de0b81",
|
|
"indicator--5813adfc-bdf8-489e-b5db-4af802de0b81",
|
|
"indicator--5813adfc-20dc-45cc-95a6-4f0e02de0b81",
|
|
"indicator--5813adfd-32dc-4035-93ed-41d502de0b81",
|
|
"indicator--5813adfd-f2fc-4793-afa2-41bc02de0b81",
|
|
"indicator--5813adfe-ba54-4581-b069-4b6302de0b81",
|
|
"indicator--5813adfe-a52c-4ff8-afae-493902de0b81",
|
|
"indicator--5813ae0d-8248-44f8-8f23-4b1302de0b81",
|
|
"indicator--5813aebd-251c-40a7-94f8-436e02de0b81",
|
|
"indicator--5813aebd-1904-4098-b439-4c8f02de0b81",
|
|
"observed-data--5813aebe-1658-4184-8f41-4f6a02de0b81",
|
|
"url--5813aebe-1658-4184-8f41-4f6a02de0b81",
|
|
"indicator--5813aebe-d88c-40e9-8879-45ca02de0b81",
|
|
"indicator--5813aebf-42ec-4f3f-a01c-49c402de0b81",
|
|
"observed-data--5813aebf-677c-4eca-9842-4e5902de0b81",
|
|
"url--5813aebf-677c-4eca-9842-4e5902de0b81",
|
|
"indicator--5813aec0-d1a8-4ca0-b209-437a02de0b81",
|
|
"indicator--5813aec0-baa0-4022-b0d5-4f2602de0b81",
|
|
"observed-data--5813aec1-a4d0-4544-a1ed-4ced02de0b81",
|
|
"url--5813aec1-a4d0-4544-a1ed-4ced02de0b81",
|
|
"indicator--5813aec1-c810-4196-90ec-4f4702de0b81",
|
|
"indicator--5813aec2-e3a4-42df-8eaa-4f7202de0b81",
|
|
"observed-data--5813aec2-9858-44c5-8fed-46a802de0b81",
|
|
"url--5813aec2-9858-44c5-8fed-46a802de0b81",
|
|
"indicator--5813aec3-39bc-4bf4-a108-497202de0b81",
|
|
"indicator--5813aec3-f708-4ed4-bc25-444002de0b81",
|
|
"observed-data--5813aec4-2700-488b-9a4c-45f302de0b81",
|
|
"url--5813aec4-2700-488b-9a4c-45f302de0b81",
|
|
"indicator--5813aec5-9f2c-4881-bd55-456302de0b81",
|
|
"indicator--5813aec5-8e1c-4e84-876f-4c4202de0b81",
|
|
"observed-data--5813aec6-dbfc-4b28-a794-44bc02de0b81",
|
|
"url--5813aec6-dbfc-4b28-a794-44bc02de0b81",
|
|
"indicator--5813aec6-03a8-4bdf-8dd7-4b0f02de0b81",
|
|
"indicator--5813aec7-7eb4-4691-9da1-4d0b02de0b81",
|
|
"observed-data--5813aec7-6390-4cb8-a043-495102de0b81",
|
|
"url--5813aec7-6390-4cb8-a043-495102de0b81",
|
|
"indicator--5813aec8-5674-4ecf-af11-45da02de0b81",
|
|
"indicator--5813aec8-37b4-460d-837e-4bd602de0b81",
|
|
"observed-data--5813aec9-05b0-44c1-8a02-484802de0b81",
|
|
"url--5813aec9-05b0-44c1-8a02-484802de0b81",
|
|
"indicator--5813aec9-b79c-4245-aa05-4c3802de0b81",
|
|
"indicator--5813aeca-073c-4a61-97b0-49e702de0b81",
|
|
"observed-data--5813aeca-9d54-4427-8581-412b02de0b81",
|
|
"url--5813aeca-9d54-4427-8581-412b02de0b81",
|
|
"indicator--5813aecb-d84c-45e8-b18f-43cd02de0b81",
|
|
"indicator--5813aecb-8888-4c4e-bcaa-43b502de0b81",
|
|
"observed-data--5813aecc-6d38-4d79-8178-47ab02de0b81",
|
|
"url--5813aecc-6d38-4d79-8178-47ab02de0b81",
|
|
"indicator--5813aecc-82ec-42dc-b68d-4a1d02de0b81",
|
|
"indicator--5813aecd-a1fc-4a44-94c8-441202de0b81",
|
|
"observed-data--5813aecd-3d44-4e94-b1e5-466f02de0b81",
|
|
"url--5813aecd-3d44-4e94-b1e5-466f02de0b81",
|
|
"indicator--5813aece-e0bc-4fb1-abd7-42ca02de0b81",
|
|
"indicator--5813aece-ed78-47bc-8c4f-40a802de0b81",
|
|
"observed-data--5813aecf-3a78-4509-87f7-44b102de0b81",
|
|
"url--5813aecf-3a78-4509-87f7-44b102de0b81",
|
|
"indicator--5813aed0-6c20-435b-be76-4c6e02de0b81",
|
|
"indicator--5813aed0-1c50-4882-a735-432902de0b81",
|
|
"observed-data--5813aed1-8428-49b0-bb3b-49d802de0b81",
|
|
"url--5813aed1-8428-49b0-bb3b-49d802de0b81",
|
|
"indicator--5813aed1-cf08-49f9-a6c7-42a302de0b81",
|
|
"indicator--5813aed2-6b94-43f7-beea-446e02de0b81",
|
|
"observed-data--5813aed2-0694-4250-89c2-499702de0b81",
|
|
"url--5813aed2-0694-4250-89c2-499702de0b81",
|
|
"indicator--5813aed3-15f8-4c9b-970d-4a1302de0b81",
|
|
"indicator--5813aed3-a058-4082-8896-4b9b02de0b81",
|
|
"observed-data--5813aed4-cdd8-4005-8197-4f8c02de0b81",
|
|
"url--5813aed4-cdd8-4005-8197-4f8c02de0b81",
|
|
"indicator--5813aed4-c13c-49f2-8224-47a002de0b81",
|
|
"indicator--5813aed5-c990-4a3a-b8d0-44ec02de0b81",
|
|
"observed-data--5813aed5-a520-400e-a38e-4e0f02de0b81",
|
|
"url--5813aed5-a520-400e-a38e-4e0f02de0b81",
|
|
"indicator--5813aed6-cee0-4024-ac95-48fc02de0b81",
|
|
"indicator--5813aed6-a0b8-4f92-845d-49cc02de0b81",
|
|
"observed-data--5813aed7-1ef8-4d60-8bd1-4d5202de0b81",
|
|
"url--5813aed7-1ef8-4d60-8bd1-4d5202de0b81",
|
|
"indicator--5813aed7-6960-462d-8677-43dc02de0b81",
|
|
"indicator--5813aed8-5604-4510-9ec1-46a602de0b81",
|
|
"observed-data--5813aed8-3718-4b56-9cf0-4ef302de0b81",
|
|
"url--5813aed8-3718-4b56-9cf0-4ef302de0b81",
|
|
"indicator--5813aed9-6374-4adb-a958-4bb102de0b81",
|
|
"indicator--5813aed9-20bc-4fba-a56a-460a02de0b81",
|
|
"observed-data--5813aeda-fed0-42d9-bc7d-448102de0b81",
|
|
"url--5813aeda-fed0-42d9-bc7d-448102de0b81",
|
|
"indicator--5813aeda-81bc-4b31-9848-4e1f02de0b81",
|
|
"indicator--5813aedb-4fc4-491e-9999-405002de0b81",
|
|
"observed-data--5813aedb-b0d0-4e2f-ade4-436b02de0b81",
|
|
"url--5813aedb-b0d0-4e2f-ade4-436b02de0b81",
|
|
"indicator--5813aedc-d48c-4e64-95ab-494502de0b81",
|
|
"indicator--5813aedc-61d0-42be-a7d5-4c5c02de0b81",
|
|
"observed-data--5813aedd-e830-429f-ba53-43ac02de0b81",
|
|
"url--5813aedd-e830-429f-ba53-43ac02de0b81",
|
|
"indicator--5813aedd-69b8-45b2-b866-4b9b02de0b81",
|
|
"indicator--5813aede-2f44-46e1-af9d-410302de0b81",
|
|
"observed-data--5813aede-9de8-4947-9889-4b0602de0b81",
|
|
"url--5813aede-9de8-4947-9889-4b0602de0b81",
|
|
"indicator--5813aedf-3ae8-4407-b4a9-49e602de0b81",
|
|
"indicator--5813aedf-f060-44a2-a2c1-449702de0b81",
|
|
"observed-data--5813aee0-a344-4f12-8d24-42ff02de0b81",
|
|
"url--5813aee0-a344-4f12-8d24-42ff02de0b81",
|
|
"indicator--5813aee0-0ffc-4e24-94f5-4d8802de0b81",
|
|
"indicator--5813aee1-60fc-4abd-9108-403c02de0b81",
|
|
"observed-data--5813aee1-63b8-4155-bbaa-4b8802de0b81",
|
|
"url--5813aee1-63b8-4155-bbaa-4b8802de0b81",
|
|
"indicator--5813aee2-cb2c-4e09-8e6f-41a802de0b81",
|
|
"indicator--5813aee2-84a0-489c-b9a5-438702de0b81",
|
|
"observed-data--5813aee3-814c-4282-8fd3-4dac02de0b81",
|
|
"url--5813aee3-814c-4282-8fd3-4dac02de0b81",
|
|
"indicator--5813aee3-fbf8-4d91-a3cc-4be202de0b81",
|
|
"indicator--5813aee4-a660-421a-b7c5-407b02de0b81",
|
|
"observed-data--5813aee4-25f8-4fd0-bbd5-455f02de0b81",
|
|
"url--5813aee4-25f8-4fd0-bbd5-455f02de0b81",
|
|
"indicator--5813aee5-ac54-4aad-be4e-48b002de0b81",
|
|
"indicator--5813aee5-5574-4540-b28d-4e6802de0b81",
|
|
"observed-data--5813aee6-88a0-4598-a33e-4f8002de0b81",
|
|
"url--5813aee6-88a0-4598-a33e-4f8002de0b81",
|
|
"indicator--5813aee6-7c84-4cad-96bc-4cc302de0b81",
|
|
"indicator--5813aee7-563c-4e84-9ec6-4cf302de0b81",
|
|
"observed-data--5813aee7-7ae8-45af-821b-4c3602de0b81",
|
|
"url--5813aee7-7ae8-45af-821b-4c3602de0b81",
|
|
"indicator--5813aee8-0398-438d-bc3a-466702de0b81",
|
|
"indicator--5813aee8-6200-4fec-bfd1-428102de0b81",
|
|
"observed-data--5813aee9-4c34-4c18-b90a-471202de0b81",
|
|
"url--5813aee9-4c34-4c18-b90a-471202de0b81",
|
|
"indicator--5813aee9-e26c-4863-838e-4ace02de0b81",
|
|
"indicator--5813aeea-c3ac-4cc4-9cc8-4e6002de0b81",
|
|
"observed-data--5813aeea-b244-4abe-8bac-413002de0b81",
|
|
"url--5813aeea-b244-4abe-8bac-413002de0b81",
|
|
"indicator--5813aeeb-dd44-466e-a272-486202de0b81",
|
|
"indicator--5813aeeb-c078-43c1-b569-431102de0b81",
|
|
"observed-data--5813aeec-c058-4ebd-b58f-463802de0b81",
|
|
"url--5813aeec-c058-4ebd-b58f-463802de0b81",
|
|
"indicator--5813aeec-6b54-4806-ae25-4e2302de0b81",
|
|
"indicator--5813aeed-3b14-4a4e-8284-460b02de0b81",
|
|
"observed-data--5813aeed-75a8-44c4-bbe4-46a402de0b81",
|
|
"url--5813aeed-75a8-44c4-bbe4-46a402de0b81",
|
|
"indicator--5813aeee-bbec-4ee8-936a-418a02de0b81",
|
|
"indicator--5813aeef-13b0-449b-a517-484702de0b81",
|
|
"observed-data--5813aeef-d6d4-47d5-a100-422102de0b81",
|
|
"url--5813aeef-d6d4-47d5-a100-422102de0b81",
|
|
"indicator--5813aef0-0aec-44b0-9154-4c0702de0b81",
|
|
"indicator--5813aef0-4284-4d94-b801-45dd02de0b81",
|
|
"observed-data--5813aef1-ab6c-453c-b13a-4a8602de0b81",
|
|
"url--5813aef1-ab6c-453c-b13a-4a8602de0b81",
|
|
"indicator--5813aef1-e47c-445a-ba49-4d5202de0b81",
|
|
"indicator--5813aef2-b358-40d5-95a5-49ae02de0b81",
|
|
"observed-data--5813aef2-a5cc-462e-96da-470902de0b81",
|
|
"url--5813aef2-a5cc-462e-96da-470902de0b81",
|
|
"indicator--5813aef2-08e4-4bb4-8c5b-41d502de0b81",
|
|
"indicator--5813aef3-7540-4479-9801-438802de0b81",
|
|
"observed-data--5813aef3-b990-442d-8184-4a1602de0b81",
|
|
"url--5813aef3-b990-442d-8184-4a1602de0b81",
|
|
"indicator--5813aef4-1934-4e7a-981d-4ea802de0b81",
|
|
"indicator--5813aef4-53fc-404b-84e7-4ef902de0b81",
|
|
"observed-data--5813aef5-c120-4a1d-9358-400802de0b81",
|
|
"url--5813aef5-c120-4a1d-9358-400802de0b81",
|
|
"indicator--5813aef5-00ec-4946-a8ab-48e402de0b81",
|
|
"indicator--5813aef6-c5b4-48a9-b48d-4b4802de0b81",
|
|
"observed-data--5813aef6-2680-498d-b8ea-40cb02de0b81",
|
|
"url--5813aef6-2680-498d-b8ea-40cb02de0b81",
|
|
"indicator--5813aef7-178c-40dc-8cc4-4a4f02de0b81",
|
|
"indicator--5813aef7-a2ac-4bae-a86e-40d302de0b81",
|
|
"observed-data--5813aef8-291c-4bc0-a0e5-402a02de0b81",
|
|
"url--5813aef8-291c-4bc0-a0e5-402a02de0b81",
|
|
"indicator--5813aef8-6544-4842-b0ab-48bb02de0b81",
|
|
"indicator--5813aef9-37e4-4e9d-9534-402602de0b81",
|
|
"observed-data--5813aef9-50a4-4d75-9b43-48bb02de0b81",
|
|
"url--5813aef9-50a4-4d75-9b43-48bb02de0b81",
|
|
"indicator--5813aefa-f15c-4f16-8936-4dca02de0b81",
|
|
"indicator--5813aefa-c9bc-425a-817f-447d02de0b81",
|
|
"observed-data--5813aefb-1a64-41de-9b74-42eb02de0b81",
|
|
"url--5813aefb-1a64-41de-9b74-42eb02de0b81",
|
|
"indicator--5813aefb-89cc-41d8-a3e2-469702de0b81",
|
|
"indicator--5813aefc-e904-4de1-beeb-4e6902de0b81",
|
|
"observed-data--5813aefc-6034-4b2e-8cfd-4b9a02de0b81",
|
|
"url--5813aefc-6034-4b2e-8cfd-4b9a02de0b81",
|
|
"indicator--5813aefd-8778-4ce8-a9ae-48fa02de0b81",
|
|
"indicator--5813aefd-0e04-4acd-a6da-406f02de0b81",
|
|
"observed-data--5813aefe-9714-4cd2-889c-4ae602de0b81",
|
|
"url--5813aefe-9714-4cd2-889c-4ae602de0b81",
|
|
"indicator--5813aefe-5390-4aca-bf2d-4d8402de0b81",
|
|
"indicator--5813aeff-380c-4685-b1c1-4a6702de0b81",
|
|
"observed-data--5813aeff-d9e0-4ce6-a15e-421802de0b81",
|
|
"url--5813aeff-d9e0-4ce6-a15e-421802de0b81",
|
|
"indicator--5813af00-7cbc-4e35-b969-474f02de0b81",
|
|
"indicator--5813af00-89c4-44b2-8f69-491902de0b81",
|
|
"observed-data--5813af01-3534-4450-8b3d-472702de0b81",
|
|
"url--5813af01-3534-4450-8b3d-472702de0b81",
|
|
"indicator--5813af01-aa50-4ba0-b8aa-42d102de0b81",
|
|
"indicator--5813af02-07bc-43a5-ac04-4d4402de0b81",
|
|
"observed-data--5813af02-67f4-45d8-87c8-43e302de0b81",
|
|
"url--5813af02-67f4-45d8-87c8-43e302de0b81",
|
|
"indicator--5813af03-986c-455d-8400-4dfd02de0b81",
|
|
"indicator--5813af03-3aa0-417d-b74e-437e02de0b81",
|
|
"observed-data--5813af04-92a8-41f5-9626-426d02de0b81",
|
|
"url--5813af04-92a8-41f5-9626-426d02de0b81",
|
|
"indicator--5813af04-83e4-413f-afac-453e02de0b81",
|
|
"indicator--5813af05-4ef4-47ba-be0d-4e5502de0b81",
|
|
"observed-data--5813af05-41ec-4aad-aaac-400602de0b81",
|
|
"url--5813af05-41ec-4aad-aaac-400602de0b81",
|
|
"indicator--5813af06-e72c-4a90-8d5d-47a402de0b81",
|
|
"indicator--5813af06-1d2c-4422-9249-449f02de0b81",
|
|
"observed-data--5813af07-0f60-445e-a478-4d6a02de0b81",
|
|
"url--5813af07-0f60-445e-a478-4d6a02de0b81",
|
|
"indicator--5813af07-4e60-422f-86d3-405502de0b81",
|
|
"indicator--5813af08-5944-4b9b-a903-40a302de0b81",
|
|
"observed-data--5813af08-9114-43f7-9525-488d02de0b81",
|
|
"url--5813af08-9114-43f7-9525-488d02de0b81",
|
|
"indicator--5813af09-2f10-4424-98c7-4b5102de0b81",
|
|
"indicator--5813af09-db34-413f-a5bd-481702de0b81",
|
|
"observed-data--5813af0a-092c-4b97-8261-454602de0b81",
|
|
"url--5813af0a-092c-4b97-8261-454602de0b81",
|
|
"indicator--5813af0a-9fcc-4d73-9328-486a02de0b81",
|
|
"indicator--5813af0b-f0a8-49d7-a5d5-473602de0b81",
|
|
"observed-data--5813af0b-de80-44e7-8951-496502de0b81",
|
|
"url--5813af0b-de80-44e7-8951-496502de0b81",
|
|
"indicator--5813af0c-cf8c-4579-a4de-4b5b02de0b81",
|
|
"indicator--5813af0c-339c-4615-8b3c-48c802de0b81",
|
|
"observed-data--5813af0d-81c0-470b-87df-46fe02de0b81",
|
|
"url--5813af0d-81c0-470b-87df-46fe02de0b81",
|
|
"indicator--5813af0d-67c8-49a0-bd07-42f202de0b81",
|
|
"indicator--5813af0e-765c-47ec-99a4-47aa02de0b81",
|
|
"observed-data--5813af0e-6904-447b-be51-4cec02de0b81",
|
|
"url--5813af0e-6904-447b-be51-4cec02de0b81",
|
|
"indicator--5813af0f-fc6c-49ca-96e6-4ee802de0b81",
|
|
"indicator--5813af0f-fb30-4ec7-81ad-494202de0b81",
|
|
"observed-data--5813af10-b7f0-42a3-b5f2-4b4d02de0b81",
|
|
"url--5813af10-b7f0-42a3-b5f2-4b4d02de0b81",
|
|
"indicator--5813af10-9e44-4531-a0c9-48f202de0b81",
|
|
"indicator--5813af11-2f98-4f72-bbc8-492302de0b81",
|
|
"observed-data--5813af11-338c-4df6-85c5-49ef02de0b81",
|
|
"url--5813af11-338c-4df6-85c5-49ef02de0b81",
|
|
"indicator--5813af12-2910-4b31-9e2f-4bcf02de0b81",
|
|
"indicator--5813af12-dbcc-4f38-bda4-435302de0b81",
|
|
"observed-data--5813af13-28e8-4c50-add7-439902de0b81",
|
|
"url--5813af13-28e8-4c50-add7-439902de0b81",
|
|
"indicator--5813af13-69ac-427b-877e-4ee302de0b81",
|
|
"indicator--5813af14-3464-4915-bf7d-4c2c02de0b81",
|
|
"observed-data--5813af14-4740-438c-958b-4b8f02de0b81",
|
|
"url--5813af14-4740-438c-958b-4b8f02de0b81",
|
|
"indicator--5813af15-d748-441e-a7a9-476b02de0b81",
|
|
"indicator--5813af15-52b8-45dc-9849-43a502de0b81",
|
|
"observed-data--5813af16-9ee0-4ff4-bd24-42ce02de0b81",
|
|
"url--5813af16-9ee0-4ff4-bd24-42ce02de0b81",
|
|
"indicator--5813af16-657c-4f19-96b6-4a6a02de0b81",
|
|
"indicator--5813af17-d00c-4811-acdd-4af002de0b81",
|
|
"observed-data--5813af17-530c-4264-9f4f-451702de0b81",
|
|
"url--5813af17-530c-4264-9f4f-451702de0b81",
|
|
"indicator--5813af18-11b8-481c-977b-4b7602de0b81",
|
|
"indicator--5813af18-81d0-4ef9-9c38-445b02de0b81",
|
|
"observed-data--5813af19-1688-440b-a348-4ae402de0b81",
|
|
"url--5813af19-1688-440b-a348-4ae402de0b81",
|
|
"indicator--5813af19-968c-4720-a287-40ed02de0b81",
|
|
"indicator--5813af1a-bc0c-45fd-84d0-4a7b02de0b81",
|
|
"observed-data--5813af1a-1418-40ab-a301-4fb602de0b81",
|
|
"url--5813af1a-1418-40ab-a301-4fb602de0b81",
|
|
"indicator--5813af1b-533c-4b3e-9ab4-4a5002de0b81",
|
|
"indicator--5813af1b-67cc-451a-bbe3-4f5d02de0b81",
|
|
"observed-data--5813af1c-2008-4acc-96a7-406c02de0b81",
|
|
"url--5813af1c-2008-4acc-96a7-406c02de0b81",
|
|
"indicator--5813af1c-f0a0-4d8c-b1ee-438502de0b81",
|
|
"indicator--5813af1d-3850-44a2-9f41-451c02de0b81",
|
|
"observed-data--5813af1d-4e58-4711-bed3-40b902de0b81",
|
|
"url--5813af1d-4e58-4711-bed3-40b902de0b81",
|
|
"indicator--5813af1e-a248-48d9-8cd7-448802de0b81",
|
|
"indicator--5813af1e-a91c-4507-b0b1-420202de0b81",
|
|
"observed-data--5813af1f-1004-43a1-a757-4a6702de0b81",
|
|
"url--5813af1f-1004-43a1-a757-4a6702de0b81",
|
|
"indicator--5813af1f-c094-42cf-a135-45bb02de0b81",
|
|
"indicator--5813af20-d1e0-4228-b216-469f02de0b81",
|
|
"observed-data--5813af20-1454-4f76-bef4-40d502de0b81",
|
|
"url--5813af20-1454-4f76-bef4-40d502de0b81",
|
|
"indicator--5813af21-c9f8-4632-b6ba-488302de0b81",
|
|
"indicator--5813af21-c180-4b6f-b6bb-4c6102de0b81",
|
|
"observed-data--5813af22-b720-414c-b497-43ac02de0b81",
|
|
"url--5813af22-b720-414c-b497-43ac02de0b81",
|
|
"indicator--5813af22-55e0-4684-afee-4e6202de0b81",
|
|
"indicator--5813af23-6674-49e5-9675-4e3302de0b81",
|
|
"observed-data--5813af23-1084-4844-910c-431202de0b81",
|
|
"url--5813af23-1084-4844-910c-431202de0b81",
|
|
"indicator--5813af24-6664-4150-b7a0-460102de0b81",
|
|
"indicator--5813af24-b710-441b-bdd8-4e7302de0b81",
|
|
"observed-data--5813af25-55a8-4d26-b440-4ec802de0b81",
|
|
"url--5813af25-55a8-4d26-b440-4ec802de0b81",
|
|
"indicator--5813af25-5584-4b55-b4e6-45d302de0b81",
|
|
"indicator--5813af26-0ef4-49bb-b947-4e0f02de0b81",
|
|
"observed-data--5813af26-101c-4eec-9882-450302de0b81",
|
|
"url--5813af26-101c-4eec-9882-450302de0b81",
|
|
"indicator--5813af27-9330-43fd-b1ac-412702de0b81",
|
|
"indicator--5813af27-13d8-473c-8c86-48a002de0b81",
|
|
"observed-data--5813af28-b5e0-46a3-b93f-4de602de0b81",
|
|
"url--5813af28-b5e0-46a3-b93f-4de602de0b81",
|
|
"indicator--5813af28-6a8c-478e-a64c-476502de0b81",
|
|
"indicator--5813af29-f560-4e1d-8bc2-402a02de0b81",
|
|
"observed-data--5813af29-3f98-41ed-8d7a-407902de0b81",
|
|
"url--5813af29-3f98-41ed-8d7a-407902de0b81",
|
|
"indicator--5813af2a-b7e8-48ae-b46c-42e802de0b81",
|
|
"indicator--5813af2a-65ac-4df9-b8dd-4bb602de0b81",
|
|
"observed-data--5813af2b-63a0-442a-8851-494702de0b81",
|
|
"url--5813af2b-63a0-442a-8851-494702de0b81",
|
|
"indicator--5813af2b-bfe4-4c80-94c7-46c902de0b81",
|
|
"indicator--5813af2c-6830-4718-b4b3-471502de0b81",
|
|
"observed-data--5813af2c-fff0-4d9d-8691-442202de0b81",
|
|
"url--5813af2c-fff0-4d9d-8691-442202de0b81",
|
|
"indicator--5813af2d-8ae8-4c3c-a986-43de02de0b81",
|
|
"indicator--5813af2d-3910-4ea8-82f8-450502de0b81",
|
|
"observed-data--5813af2e-6c50-4cf9-b027-49b902de0b81",
|
|
"url--5813af2e-6c50-4cf9-b027-49b902de0b81",
|
|
"indicator--5813af2e-2ca4-4fca-8e71-46c602de0b81",
|
|
"indicator--5813af2f-0ffc-4a7f-9eb7-48cc02de0b81",
|
|
"observed-data--5813af2f-4054-4c40-86df-419102de0b81",
|
|
"url--5813af2f-4054-4c40-86df-419102de0b81",
|
|
"indicator--5813af30-6584-43b1-9b64-415f02de0b81",
|
|
"indicator--5813af30-0404-479a-986a-453702de0b81",
|
|
"observed-data--5813af31-4e44-4977-98b5-47cc02de0b81",
|
|
"url--5813af31-4e44-4977-98b5-47cc02de0b81",
|
|
"indicator--5813af31-b51c-40dd-8287-473802de0b81",
|
|
"indicator--5813af32-817c-4879-8a41-4a4102de0b81",
|
|
"observed-data--5813af32-e964-4819-a123-492e02de0b81",
|
|
"url--5813af32-e964-4819-a123-492e02de0b81",
|
|
"indicator--5813af33-868c-4472-933a-439e02de0b81",
|
|
"indicator--5813af33-6260-40d6-a7e4-4ad502de0b81",
|
|
"observed-data--5813af34-6d84-4b2c-9dc4-45a902de0b81",
|
|
"url--5813af34-6d84-4b2c-9dc4-45a902de0b81",
|
|
"indicator--5813af34-64ac-4fa3-ae9f-482702de0b81",
|
|
"indicator--5813af35-8a34-4eb6-b1c2-4e2602de0b81",
|
|
"observed-data--5813af35-1680-47de-96a9-400f02de0b81",
|
|
"url--5813af35-1680-47de-96a9-400f02de0b81",
|
|
"indicator--5813af36-de78-4057-ad16-478002de0b81",
|
|
"indicator--5813af36-68dc-44b6-acca-4d6902de0b81",
|
|
"observed-data--5813af37-41f4-4365-a5c3-4bfc02de0b81",
|
|
"url--5813af37-41f4-4365-a5c3-4bfc02de0b81",
|
|
"indicator--5813af37-5e90-4ecc-be3e-47ff02de0b81",
|
|
"indicator--5813af38-42ac-4f49-bd50-4c7702de0b81",
|
|
"observed-data--5813af38-0200-40ee-9d94-4aa902de0b81",
|
|
"url--5813af38-0200-40ee-9d94-4aa902de0b81",
|
|
"indicator--5813af39-4004-41de-a47b-40ff02de0b81",
|
|
"indicator--5813af39-54ec-4803-8284-43cc02de0b81",
|
|
"observed-data--5813af3a-6910-497f-babe-49d202de0b81",
|
|
"url--5813af3a-6910-497f-babe-49d202de0b81",
|
|
"indicator--5813af3a-171c-4526-9340-4e9102de0b81",
|
|
"indicator--5813af3b-6e60-4f1f-ae4e-4c8d02de0b81",
|
|
"observed-data--5813af3b-f1cc-438e-8bd5-437702de0b81",
|
|
"url--5813af3b-f1cc-438e-8bd5-437702de0b81",
|
|
"indicator--5813af3c-5474-4aae-a146-41dd02de0b81",
|
|
"indicator--5813af3c-f930-4335-b545-467002de0b81",
|
|
"observed-data--5813af3d-0bf0-4668-a794-4f0f02de0b81",
|
|
"url--5813af3d-0bf0-4668-a794-4f0f02de0b81",
|
|
"indicator--5813af3d-9eb4-4d20-909b-4e2c02de0b81",
|
|
"indicator--5813af3e-1ffc-48e8-b9f2-480902de0b81",
|
|
"observed-data--5813af3e-ea5c-443d-9d87-4e8502de0b81",
|
|
"url--5813af3e-ea5c-443d-9d87-4e8502de0b81",
|
|
"indicator--5813af3f-9e3c-4f25-85f1-405e02de0b81",
|
|
"indicator--5813af3f-ace8-4bbb-ad8d-450802de0b81",
|
|
"observed-data--5813af40-b5cc-4584-833b-4fde02de0b81",
|
|
"url--5813af40-b5cc-4584-833b-4fde02de0b81",
|
|
"indicator--5813af40-a824-4a92-9134-499b02de0b81",
|
|
"indicator--5813af41-a700-4ab2-bb9a-448702de0b81",
|
|
"observed-data--5813af41-3e04-4c01-87b1-42f402de0b81",
|
|
"url--5813af41-3e04-4c01-87b1-42f402de0b81",
|
|
"indicator--5813af42-9428-4b48-9188-4dd602de0b81",
|
|
"indicator--5813af42-0324-4a8f-a62f-4f3602de0b81",
|
|
"observed-data--5813af43-fb98-4a5e-8632-457402de0b81",
|
|
"url--5813af43-fb98-4a5e-8632-457402de0b81",
|
|
"indicator--5813af43-ada8-4abe-921d-4f8802de0b81",
|
|
"indicator--5813af44-0ae4-4628-a78f-418c02de0b81",
|
|
"observed-data--5813af44-8204-4740-ae4b-4bce02de0b81",
|
|
"url--5813af44-8204-4740-ae4b-4bce02de0b81",
|
|
"indicator--5813af45-0028-4e87-b5f1-403902de0b81",
|
|
"indicator--5813af45-c3e0-48b9-a2b3-43c902de0b81",
|
|
"observed-data--5813af46-97ec-4824-9351-4c5002de0b81",
|
|
"url--5813af46-97ec-4824-9351-4c5002de0b81",
|
|
"indicator--5813af46-1338-46ce-930e-4ae202de0b81",
|
|
"indicator--5813af47-6bec-4851-969f-410002de0b81",
|
|
"observed-data--5813af47-a41c-4684-81a3-440902de0b81",
|
|
"url--5813af47-a41c-4684-81a3-440902de0b81",
|
|
"indicator--5813af48-2ff4-45b9-a2b3-412202de0b81",
|
|
"indicator--5813af48-a16c-4aaa-bda5-4ef302de0b81",
|
|
"observed-data--5813af49-3d84-4b5e-97e7-4cd502de0b81",
|
|
"url--5813af49-3d84-4b5e-97e7-4cd502de0b81",
|
|
"indicator--5813af49-2544-4aea-9b24-48c602de0b81",
|
|
"indicator--5813af4a-6934-418d-b80b-482f02de0b81",
|
|
"observed-data--5813af4a-2ef0-4da3-9b11-4e9d02de0b81",
|
|
"url--5813af4a-2ef0-4da3-9b11-4e9d02de0b81",
|
|
"indicator--5813af4b-1fe4-44ec-a100-415e02de0b81",
|
|
"indicator--5813af4b-69e4-41e0-83c6-4c4f02de0b81",
|
|
"observed-data--5813af4c-11bc-48ae-b6e5-4f7a02de0b81",
|
|
"url--5813af4c-11bc-48ae-b6e5-4f7a02de0b81",
|
|
"indicator--5813af4c-2910-4fdb-a1aa-4d7b02de0b81",
|
|
"indicator--5813af4d-4c7c-4822-b248-46df02de0b81",
|
|
"observed-data--5813af4d-69f0-4015-a497-489e02de0b81",
|
|
"url--5813af4d-69f0-4015-a497-489e02de0b81",
|
|
"indicator--5813af4e-ae44-4c69-a045-498802de0b81",
|
|
"indicator--5813af4e-624c-4fa9-8bd8-47f102de0b81",
|
|
"observed-data--5813af4f-b468-4b8e-b6ba-4b3102de0b81",
|
|
"url--5813af4f-b468-4b8e-b6ba-4b3102de0b81",
|
|
"indicator--5813af4f-83a0-4eb8-bef5-4a9a02de0b81",
|
|
"indicator--5813af50-40b4-4bd8-ae33-4df102de0b81",
|
|
"observed-data--5813af50-f608-406c-bd67-48e202de0b81",
|
|
"url--5813af50-f608-406c-bd67-48e202de0b81",
|
|
"indicator--5813af51-2040-4a74-a1fd-437502de0b81",
|
|
"indicator--5813af51-f4cc-41d7-9662-4e4802de0b81",
|
|
"observed-data--5813af51-1a18-45b8-8637-428f02de0b81",
|
|
"url--5813af51-1a18-45b8-8637-428f02de0b81",
|
|
"indicator--5813af52-f52c-4df2-815c-4f8c02de0b81",
|
|
"indicator--5813af52-2cc4-4670-969a-4af802de0b81",
|
|
"observed-data--5813af53-6d90-4649-b332-46d802de0b81",
|
|
"url--5813af53-6d90-4649-b332-46d802de0b81",
|
|
"indicator--5813af53-8b54-4009-8f9c-4f3302de0b81",
|
|
"indicator--5813af54-5e2c-4e3f-b671-488c02de0b81",
|
|
"observed-data--5813af54-7c74-40d7-9bb1-493e02de0b81",
|
|
"url--5813af54-7c74-40d7-9bb1-493e02de0b81",
|
|
"indicator--5813af55-9924-4703-b53c-4dc902de0b81",
|
|
"indicator--5813af55-a294-4fc2-b7d7-439402de0b81",
|
|
"observed-data--5813af56-32b0-4631-a3e2-4e1602de0b81",
|
|
"url--5813af56-32b0-4631-a3e2-4e1602de0b81",
|
|
"indicator--5813af56-b6cc-4bc0-ba1e-4f4902de0b81",
|
|
"indicator--5813af57-5b04-489a-96a8-4e6102de0b81",
|
|
"observed-data--5813af57-80a0-4f6a-8c82-4e1b02de0b81",
|
|
"url--5813af57-80a0-4f6a-8c82-4e1b02de0b81",
|
|
"indicator--5813af58-b538-4b8a-981f-41de02de0b81",
|
|
"indicator--5813af58-d36c-4b0b-b8a3-4edc02de0b81",
|
|
"observed-data--5813af59-7210-4aa8-87cd-466602de0b81",
|
|
"url--5813af59-7210-4aa8-87cd-466602de0b81",
|
|
"indicator--5813af59-cee4-4dee-b2e6-4ad102de0b81",
|
|
"indicator--5813af5a-9cfc-417b-9d76-49b802de0b81",
|
|
"observed-data--5813af5a-0d90-4cac-9908-47c802de0b81",
|
|
"url--5813af5a-0d90-4cac-9908-47c802de0b81",
|
|
"indicator--5813af5b-7738-4b91-9890-467502de0b81",
|
|
"indicator--5813af5b-6854-4a46-88fb-45a002de0b81",
|
|
"observed-data--5813af5c-5650-48f9-8248-470c02de0b81",
|
|
"url--5813af5c-5650-48f9-8248-470c02de0b81",
|
|
"indicator--5813af5c-a204-4502-8466-475302de0b81",
|
|
"indicator--5813af5d-da64-4206-ba70-429702de0b81",
|
|
"observed-data--5813af5d-3e14-4f73-9035-495802de0b81",
|
|
"url--5813af5d-3e14-4f73-9035-495802de0b81",
|
|
"indicator--5813af5e-64c8-4605-93de-438502de0b81",
|
|
"indicator--5813af5e-4738-46a1-9fa8-416b02de0b81",
|
|
"observed-data--5813af5f-0610-45a6-b821-4fcc02de0b81",
|
|
"url--5813af5f-0610-45a6-b821-4fcc02de0b81",
|
|
"indicator--5813af5f-ea18-44b5-89ad-4eb702de0b81",
|
|
"indicator--5813af60-69ec-4fdd-b67e-486502de0b81",
|
|
"observed-data--5813af60-cab4-4d1d-b29f-4e6e02de0b81",
|
|
"url--5813af60-cab4-4d1d-b29f-4e6e02de0b81",
|
|
"indicator--5813af61-ca98-480a-bdc3-4ba702de0b81",
|
|
"indicator--5813af61-9d28-4c31-affa-415002de0b81",
|
|
"observed-data--5813af62-ca7c-453b-80db-4b6f02de0b81",
|
|
"url--5813af62-ca7c-453b-80db-4b6f02de0b81",
|
|
"indicator--5813af62-33f4-4ac6-a77b-4e9902de0b81",
|
|
"indicator--5813af63-e4c8-48d9-abde-48d002de0b81",
|
|
"observed-data--5813af63-e12c-4a61-ac35-4fff02de0b81",
|
|
"url--5813af63-e12c-4a61-ac35-4fff02de0b81",
|
|
"indicator--5813af64-e2a0-43cd-b35d-4c3502de0b81",
|
|
"indicator--5813af64-fa50-4ad6-9131-4b7302de0b81",
|
|
"observed-data--5813af65-55b0-43ed-94cc-48e202de0b81",
|
|
"url--5813af65-55b0-43ed-94cc-48e202de0b81",
|
|
"indicator--5813af65-ce44-400b-a6e0-497102de0b81",
|
|
"indicator--5813af66-fed8-4747-9bad-495302de0b81",
|
|
"observed-data--5813af66-9844-4edd-98b8-46ad02de0b81",
|
|
"url--5813af66-9844-4edd-98b8-46ad02de0b81",
|
|
"indicator--5813af67-852c-4695-9c64-480302de0b81",
|
|
"indicator--5813af67-b088-4628-a97e-4c8602de0b81",
|
|
"observed-data--5813af68-7af4-44c6-a18a-431902de0b81",
|
|
"url--5813af68-7af4-44c6-a18a-431902de0b81",
|
|
"indicator--5813af68-a350-44e3-a145-458702de0b81",
|
|
"indicator--5813af69-6480-4d07-a261-4c7702de0b81",
|
|
"observed-data--5813af69-0238-4ce8-8f1b-44f602de0b81",
|
|
"url--5813af69-0238-4ce8-8f1b-44f602de0b81",
|
|
"indicator--5813af6a-5da0-4097-9102-43c602de0b81",
|
|
"indicator--5813af6a-ce88-49d7-b4f9-4cf902de0b81",
|
|
"observed-data--5813af6a-6a54-4545-a0ac-47d802de0b81",
|
|
"url--5813af6a-6a54-4545-a0ac-47d802de0b81",
|
|
"indicator--5813af6b-bad8-4f72-a283-49c602de0b81",
|
|
"indicator--5813af6b-8c6c-4ffd-9437-448c02de0b81",
|
|
"observed-data--5813af6c-fc80-46b7-a0d5-4a0802de0b81",
|
|
"url--5813af6c-fc80-46b7-a0d5-4a0802de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"ms-caro-malware:malware-platform=\"Linux\"",
|
|
"circl:incident-classification=\"malware\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813ad55-a024-44f0-afb5-4c4d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:56:05.000Z",
|
|
"modified": "2016-10-28T19:56:05.000Z",
|
|
"first_observed": "2016-10-28T19:56:05Z",
|
|
"last_observed": "2016-10-28T19:56:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813ad55-a024-44f0-afb5-4c4d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813ad55-a024-44f0-afb5-4c4d02de0b81",
|
|
"value": "https://thisissecurity.net/2016/10/28/octopus-rex-evolution-of-a-multi-task-botnet/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5813ad6d-5c50-4601-9deb-4a9002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:56:28.000Z",
|
|
"modified": "2016-10-28T19:56:28.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "During the last decade, different types of malware have been targeting Linux servers; Elknot, Encoder, Mirai, LuaBot, NyaDrop, Gayfgt etc. Most of them are used for DDoS purpose but there are some exceptions. Rex is one of them.\r\nIn this article we\u00e2\u20ac\u2122ll try to present a detailed analysis of Rex.\r\nRex is a new malware developed in Go. Monitoring its activity over the last seven months brought out the efforts for developing various features."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbd-4df4-47cc-93c5-488202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:49.000Z",
|
|
"modified": "2016-10-28T19:57:49.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'f14b398584729f13317b229f06356c7fa222c11ad916a95afe78bfc20404d6a4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbd-9f68-4078-8205-4e3502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:49.000Z",
|
|
"modified": "2016-10-28T19:57:49.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '97c1ed3d52d663f9bad2eef716169f06053dc2bcf8e3d857b0a702e8fae546c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbe-48c8-4ef6-b2ad-489002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:50.000Z",
|
|
"modified": "2016-10-28T19:57:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '762a4f2bf5ea4ff72fce674da1adf29f0b9357be18de4cd992d79198c56bb514']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbe-36a8-4c53-8fa2-4ad202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:50.000Z",
|
|
"modified": "2016-10-28T19:57:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '71d8d1a50db2bf3edce85ae5e5614dac63f9c7d2efd6494956dc8b7af3513e8d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbe-316c-4e9d-b576-485002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:50.000Z",
|
|
"modified": "2016-10-28T19:57:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2cca695f859b3fddf0e934c6b05334ad940aae288061b83ddab786fcb24d2ae0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbe-e9dc-4f53-a832-4b8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:50.000Z",
|
|
"modified": "2016-10-28T19:57:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '1fd98eabd378aa0526a362499c14bb8c5146c2615ee4a3731146fd61bdca36b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbf-e944-4d5c-aaa7-408c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:51.000Z",
|
|
"modified": "2016-10-28T19:57:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd67ae5639618a3409711377e124ef2c6293200aa3026b8b2996654db63645481']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbf-2964-4b6e-ac70-434702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:51.000Z",
|
|
"modified": "2016-10-28T19:57:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '444284e41eea3dae1771d25c3e18d0bf8f85e3cb3658d2c3b91ea685f139bf4b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbf-30d4-4a1f-8a56-435402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:51.000Z",
|
|
"modified": "2016-10-28T19:57:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9909910d6e008e15c98d26e214f619a7a82787137158784998d99b5c03cbe8f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adbf-f960-442e-95b2-4e6f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:51.000Z",
|
|
"modified": "2016-10-28T19:57:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'dcd0e1586630bc8c50fe600899bee76b853057fd9158ed541d7ddec53c8f2186']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc0-9cbc-4869-8566-47a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:52.000Z",
|
|
"modified": "2016-10-28T19:57:52.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3f53926f825d1f17999745983654cce4adb6d106d913d337920c41cc8a857a4d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc0-42c0-4fb7-834e-4bbc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:52.000Z",
|
|
"modified": "2016-10-28T19:57:52.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'ddb19f88a0f8b9f86c9b6ec5ef5bdd01a026b0ca65d59cc38fbb2b4c42811296']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc1-b780-4507-9187-494f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:53.000Z",
|
|
"modified": "2016-10-28T19:57:53.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'aa27d4ec34eb9ff93f99a3d8108e29c28b43c3719dacbe95f44c3476a142d457']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc1-eea8-4f7c-a9a6-4b7d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:53.000Z",
|
|
"modified": "2016-10-28T19:57:53.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '06fe8decf5dfd6fe0655ff6e5156576666a7a536f53cfa2013b8d9ca11e76a84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc2-7a90-4a57-93a0-4c2202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:54.000Z",
|
|
"modified": "2016-10-28T19:57:54.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'b26781cc1011c7a844e512ad88213ea64e3470d21eda73287b8c1d6c0370dae1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc2-6f10-4ba7-8e7e-4f9602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:54.000Z",
|
|
"modified": "2016-10-28T19:57:54.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2f6c54a9cb83dc72cfd14809db9d394daaa3bca1dc0b5ff73ba13501e9407ec6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc3-de1c-4cad-9e7f-411202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:55.000Z",
|
|
"modified": "2016-10-28T19:57:55.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '08f8a4dad2ddb9e44b3371634157f302966b930f4a07504f1a7f9ba70b5310f6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc3-b580-4ec7-b439-4bf102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:55.000Z",
|
|
"modified": "2016-10-28T19:57:55.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd24ca01f15e7b341eb2fcc0e83a55f0c2d87343bd7c018a5236ca58040a91466']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc4-8754-40a6-8d9f-40cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:56.000Z",
|
|
"modified": "2016-10-28T19:57:56.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'a1610e735042ce0197859e6fd7772039e63efce78d6c9cf642492d1c8f1d7540']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc4-fcec-465b-8e36-486202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:56.000Z",
|
|
"modified": "2016-10-28T19:57:56.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3da2ddcef59f12f4879de1c6a0f1c6f016b1042ad2639ec2c4aa12b9c315d10f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc5-d21c-42f2-8788-493402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:57.000Z",
|
|
"modified": "2016-10-28T19:57:57.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '0723de24bc86eedde149c53e0f93a18596bed424e823f1b46c2f97e358931b83']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc6-4538-4c9e-a748-42c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:58.000Z",
|
|
"modified": "2016-10-28T19:57:58.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '52bf6ae8fe7a0a59ca8d089444207c173e20a7a11c8b5e815b937e2f4224da4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc6-becc-4ef4-8714-447f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:58.000Z",
|
|
"modified": "2016-10-28T19:57:58.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3e4cebd60a1d6a6b29bac68ace2547c2e3894a0e5865dd90aff5764f8e7dc16d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc7-c1cc-4f8d-b809-4a9c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:59.000Z",
|
|
"modified": "2016-10-28T19:57:59.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '192a67ed44d5e7fd33ba80b90abf69e2af8a60f32cf89d77ef0dc93425695867']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc7-e4cc-40b9-8a7f-4bdc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:57:59.000Z",
|
|
"modified": "2016-10-28T19:57:59.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '6428046c24aace0575c1a1443eedb7abe92ccde0fdc1f83827a54306959d0f3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:57:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc8-c0d4-4e65-8e41-4ad502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:00.000Z",
|
|
"modified": "2016-10-28T19:58:00.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '1b2ff46200ed68a210ae3a406777f6d762b5de91ab335fa6766e6514c33200e9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc8-972c-47bc-b4b1-450802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:00.000Z",
|
|
"modified": "2016-10-28T19:58:00.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2934da8eb30d59c001767fb8e28ccb728af8b2c8b8258a7453b85a5b0e340254']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc9-9aa0-4536-bc3b-479002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:01.000Z",
|
|
"modified": "2016-10-28T19:58:01.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'c058d576a108bdcf637a6ed399b4d9a1e3bbb6f194882ffada01b85e79109f65']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adc9-5b00-41d5-a0dc-4ca102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:01.000Z",
|
|
"modified": "2016-10-28T19:58:01.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '09f1967e97a97a1d0963a84823fa2611b9555866f09d7a04bb69bc4d877f9631']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adca-1f64-41cd-bbc4-4c4b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:02.000Z",
|
|
"modified": "2016-10-28T19:58:02.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'dbb7c4548d49207eb772ff85657a7d9a0eeec24efb6e3b85f5dc94207df4a223']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adca-ba28-4a4b-81d5-4a8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:02.000Z",
|
|
"modified": "2016-10-28T19:58:02.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '40c882738ea1e01cc4e8027dd6ce5d55552e5630c8f65e86db630fca09d85fa9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcb-cfb8-4845-af37-48ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:03.000Z",
|
|
"modified": "2016-10-28T19:58:03.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '69402f4bd7718a3403f1caaaa387edc70b299f6aecc06de39e3a9ac28873a184']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcb-6e60-4f92-90d3-41dc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:03.000Z",
|
|
"modified": "2016-10-28T19:58:03.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '550b9b4c5b2dbe83fa3e227cca65b9b9768e2ea597c2e109205dba51faee5869']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcc-5ac4-4c7e-8988-42b002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:04.000Z",
|
|
"modified": "2016-10-28T19:58:04.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '81f1925eb2b49a0f18a6036a0cfd0385f1405d6fa0ee7a80f4162a9c6eefc5a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcd-ad84-44cc-a15b-483302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:05.000Z",
|
|
"modified": "2016-10-28T19:58:05.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '950cd068d9c51b941bdfe4721a3156af15dc408d2df23c1f2bc41b87159b109e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcd-4914-4a77-ac65-427f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:05.000Z",
|
|
"modified": "2016-10-28T19:58:05.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '47e9acdba48dfb1948a409b89341b45834e8c3a27cf9e01dfacc7b37c797a3ab']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adce-497c-48aa-9d45-4d5f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:06.000Z",
|
|
"modified": "2016-10-28T19:58:06.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '25ec78c719882cbfe19fbed160d8e50f25d725c6c7b7458ab42f5dda91dee203']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adce-f0dc-4162-95e5-4da502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:06.000Z",
|
|
"modified": "2016-10-28T19:58:06.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2549560970bb8ebca0136f7d6c8111196295d083c6fd6101a7f9178089502cc0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adcf-01ac-432f-813a-45c702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:07.000Z",
|
|
"modified": "2016-10-28T19:58:07.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '8e7eaed42f50c865f72f7351b87a988de5aa94781b4dab4ddbe993872435f293']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add0-bc30-4bb8-9dcf-453f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:08.000Z",
|
|
"modified": "2016-10-28T19:58:08.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'c53923874225931ca94799099b86ac5f68b491d3aa7f2773f224adcf6294caf7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add0-b25c-4235-ad1a-443402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:08.000Z",
|
|
"modified": "2016-10-28T19:58:08.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '30aaf21b1cba8cffcdb0e710316d5a0b7f67b10138997dc5f36a447d48c03a3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add1-7600-406c-a3e3-45b202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:09.000Z",
|
|
"modified": "2016-10-28T19:58:09.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '04f865ddb593a39b4153b030ae723c9099a46a481e93fdbcc3bf8daea731e4b3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add1-8ab8-4250-91b9-4a3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:09.000Z",
|
|
"modified": "2016-10-28T19:58:09.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '53a5d799f91a6b5ae4878dcdc933cb497eac57b750744998feb8f07d9f683d22']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add2-734c-4ed1-9c4e-47e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:10.000Z",
|
|
"modified": "2016-10-28T19:58:10.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '5088f65fe343d3f698765289098bd9d35c4968f113d2ad4920eeb511b075383a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add3-9e74-4971-acf4-41d202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:11.000Z",
|
|
"modified": "2016-10-28T19:58:11.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'a1000d4cb81cfb7dfac660722938f3d9c7cb6e36c33e129097ddd29f3dfd1890']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add3-9d70-4c17-ade9-462302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:11.000Z",
|
|
"modified": "2016-10-28T19:58:11.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '208bfc3480b620aa39cb6da5eaf04dd9ad0665bdde16423634ae3c90e1242157']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add4-533c-4f64-a044-436902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:12.000Z",
|
|
"modified": "2016-10-28T19:58:12.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2963835a0ba3476cffd75e527bfe50dc490efae252e1cdecd581438e2fd15957']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add5-64b0-49c6-b678-46a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:13.000Z",
|
|
"modified": "2016-10-28T19:58:13.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '7b0e6e65d0b3c7c82eb3041505a217feb5db1702e4f284dcfdb4fe28b166c13c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add5-82b4-49bb-b11a-404502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:13.000Z",
|
|
"modified": "2016-10-28T19:58:13.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3c214302047db629f6ac84e5495af21e8cb73497c587862236477b731d304640']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add6-fe70-4395-a94b-47be02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:14.000Z",
|
|
"modified": "2016-10-28T19:58:14.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'aea3ccce007af974123c68c64dc19d6e7745f5966d7269da8e9e551551702dea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add6-1fa8-4775-b0ab-4bf702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:14.000Z",
|
|
"modified": "2016-10-28T19:58:14.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '4d6563811972d1cd663e95bbdcfa06c1320445c0bbe1d370403253325d764357']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add7-1b20-42cf-86e9-409902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:15.000Z",
|
|
"modified": "2016-10-28T19:58:15.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2c091e180910f751813cb6169025e33161f1c0b9fe1443bf3aab40281820e331']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add8-1e84-4bdc-96f8-412b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:16.000Z",
|
|
"modified": "2016-10-28T19:58:16.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '8cb70ac6d9b7da09c30514dce788b9626f8c115d3aff9d50ca97667de1e834c4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add8-95a0-499b-a3a3-41bb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:16.000Z",
|
|
"modified": "2016-10-28T19:58:16.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '8f5996d84577318b2081061d4dc583a2d7bea3a9d77052ac6be51ef180587608']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813add9-09f8-4dff-b9e5-408302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:17.000Z",
|
|
"modified": "2016-10-28T19:58:17.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd282f723998a4b0768a8d3e1c73997cf9ab9fcee43e4a7f0c8c76e9cff67d347']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adda-c1dc-494e-85ac-4c2e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:18.000Z",
|
|
"modified": "2016-10-28T19:58:18.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '22c30799fc61601d22ab5ee5076512814eb0bcc8ea215c13e079c59c155b9412']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adda-4740-4ef6-b7ad-48f402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:18.000Z",
|
|
"modified": "2016-10-28T19:58:18.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '251a2e72eee5581aafbb9d109cf0133a07b8426950de381020849347dd619f18']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addb-14f4-4af9-9d69-4daa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:19.000Z",
|
|
"modified": "2016-10-28T19:58:19.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '64c62a718a1998ead5b49b0b859253673d69135d3a2508ccd923f16fd6232fc5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addb-a318-4d66-a2aa-40a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:19.000Z",
|
|
"modified": "2016-10-28T19:58:19.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2b7555bfa3794903bd59955db795213bcb5c9d678029184967ad8f71cc653980']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addc-38f0-41fe-b8fd-4f6b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:20.000Z",
|
|
"modified": "2016-10-28T19:58:20.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9d41dc182dee0690e5c5f08f9276548a85f4b986478fd30ec4208d95d54cffeb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addc-8d1c-4667-b3a6-48db02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:20.000Z",
|
|
"modified": "2016-10-28T19:58:20.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'b30dfa13f8dc7162f3edb43dff8507f82c01bd5bd6e5a1ae2e3b2e55dd6b10c0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addd-677c-4f95-ae18-47d402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:21.000Z",
|
|
"modified": "2016-10-28T19:58:21.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '1e8341e46820af65a9fdbdcfa55b7c1556449cc99755545063082394d764eab5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adde-b340-4ec2-b475-4ee102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:22.000Z",
|
|
"modified": "2016-10-28T19:58:22.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '46337159fc31aac4ca678d86101ab2a0f08345a6604c18c1d8071f32056cd0ad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adde-e698-4f3b-b1e8-444d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:22.000Z",
|
|
"modified": "2016-10-28T19:58:22.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'fcd621c978e203ca3bc698f84353a0674888122a8d26bc288d28f53f1968b6d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addf-db14-4314-86c4-465502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:23.000Z",
|
|
"modified": "2016-10-28T19:58:23.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3606303974653b5dc9ece6700997c462192f169aa0e63f3a9c031b87370643ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813addf-142c-41b1-bc1d-4eb802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:23.000Z",
|
|
"modified": "2016-10-28T19:58:23.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '4524d20635f86743572459761fec72cac6efa5bb4a35e19426c342609505a013']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade0-65fc-41ce-ad4e-45b502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:24.000Z",
|
|
"modified": "2016-10-28T19:58:24.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'a78230219df28b5274580a2fb7693bca98a2217ad5d1c25a5db2f853871a2e89']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade1-4dd4-41d7-a3b9-4b6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:25.000Z",
|
|
"modified": "2016-10-28T19:58:25.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2d468ca14aa7c9367f2233197ffcd0cf3703ac6a087f5b9c06ea72eb29bc00eb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade1-5688-48ed-9ece-4c0d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:25.000Z",
|
|
"modified": "2016-10-28T19:58:25.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'ff09e360d68a8c84646cba8898812c8d967e48ad33f0950da2492104312c7aea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade2-4d40-492c-b404-422102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:26.000Z",
|
|
"modified": "2016-10-28T19:58:26.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '0e6c53797964b611c867cb5e5b492d45edf5472924c9a60a99433240f1712f15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade2-7d1c-46d8-851b-4e0302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:26.000Z",
|
|
"modified": "2016-10-28T19:58:26.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '7ee718e31ce160126cfdc88fedd1a936b91550c3d2906927818eb7fd8ab2d149']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade3-4a88-4352-8b18-4e6002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:27.000Z",
|
|
"modified": "2016-10-28T19:58:27.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '18bbffd0e4beb9bc9b7b5c53abeaee44cc16abbffa5a3481035acd0ad26cf248']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade4-af3c-4f51-bc5c-458202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:28.000Z",
|
|
"modified": "2016-10-28T19:58:28.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '6b46b6eff4be06d47284492fed7f71c53103bfaa610952151bddebb8046a34f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade4-1ed8-46c5-8bf4-490d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:28.000Z",
|
|
"modified": "2016-10-28T19:58:28.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '4b513dfc68fe825e5f83c51fc1a023c15bf1039e48e025a0a4f4b034dbf443b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade5-9f58-42c7-8dd4-433c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:29.000Z",
|
|
"modified": "2016-10-28T19:58:29.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'afaa75870b6333fa4d4c4e337dc9a2e3d9cc4493599fa21b9ad4e50d802f98b5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade6-161c-4b5f-9b18-484102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:30.000Z",
|
|
"modified": "2016-10-28T19:58:30.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '5c8269ab600d6ccd73f5b57871300585cf034716e61dda019132b0ac8d20a954']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade6-3d20-44f0-9f56-438b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:30.000Z",
|
|
"modified": "2016-10-28T19:58:30.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'cb42573e36fb148bc1109229a1025cdcb375c166361605f0681da9e54e3ef81d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade7-0f64-46de-9602-4f0202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:31.000Z",
|
|
"modified": "2016-10-28T19:58:31.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '677464da2fcf73b9793daca3191501da02957af08a6471a047410ce99ea49405']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade7-b280-4e81-b5df-467902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:31.000Z",
|
|
"modified": "2016-10-28T19:58:31.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'efdb2de4f0534c1209222936d0973d2a0cc47e3b87a358718b0486da86676ce8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade8-99d8-445f-babd-4c7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:32.000Z",
|
|
"modified": "2016-10-28T19:58:32.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd097f55f82e88a32b057010c96f553aa7c8ccef12c2a8484aab0fb3dab9d4a0f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade9-6a64-46e7-829a-4d1802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:33.000Z",
|
|
"modified": "2016-10-28T19:58:33.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'a76a5ee67521c74d72cb1e533edab048d9fa54e86dbdb65209b6d47295f59559']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ade9-1ec4-4d2e-ad07-42ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:33.000Z",
|
|
"modified": "2016-10-28T19:58:33.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'a3dbdc19534e24be02c8bee896664e0de611410cd37b53445480e180ced4305f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adea-3f20-4bb1-a81e-410c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:34.000Z",
|
|
"modified": "2016-10-28T19:58:34.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9070f56651f44ec722e17df67b8a954888e387a8f2574594c80937d0f39c471a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adea-83c0-49cc-a2b8-4d8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:34.000Z",
|
|
"modified": "2016-10-28T19:58:34.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'f141e71e98e635dec4918854bfca84bf94e24bf0ce5d54c0a3802317d8790c14']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adeb-b1bc-4efa-8991-4fc602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:35.000Z",
|
|
"modified": "2016-10-28T19:58:35.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'cc01ba0825208402b0fc2eb62146e856f69d1e9f53b745d8f068f0d09e6170c0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adec-e780-4271-adde-497e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:36.000Z",
|
|
"modified": "2016-10-28T19:58:36.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'fe2c837d1662ca47ebd86c0cf0a3a382ee589bce6b77dabae30801d71a7d280f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adec-a918-42ee-8d5c-444902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:36.000Z",
|
|
"modified": "2016-10-28T19:58:36.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '62b5b723195abc5c75ffb03707baf9261395b429359282a3dbd8c2f00f125028']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aded-b7e4-4398-87ee-4e4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:37.000Z",
|
|
"modified": "2016-10-28T19:58:37.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '91164673cda591a9a4dec91ecda6dbb515d48df7b56108b5fa0053395c733188']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aded-28f0-4c90-b5f3-46b602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:37.000Z",
|
|
"modified": "2016-10-28T19:58:37.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'daa738f9ebd1ef2899430efad81d2b870aa665a0cb322614e1880454d3215bf7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adee-5b30-4730-b745-45cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:38.000Z",
|
|
"modified": "2016-10-28T19:58:38.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9583377cf54642118cee629e5b0fb3c708a46d584ce1e5e5121bded18e071e39']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adef-cb40-46f4-9e53-445002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:39.000Z",
|
|
"modified": "2016-10-28T19:58:39.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'e0a198d524b7cd6995d53a9e30a88072f866ae66ecde8f5e3f1fff204d3d8a49']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adef-37e8-4267-9016-49d902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:39.000Z",
|
|
"modified": "2016-10-28T19:58:39.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '1f4d876b17a6d786aa793b9c529235f9f9e164d70a74d8d26ca850d18f1329a7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf0-9c40-40f6-a14d-430a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:40.000Z",
|
|
"modified": "2016-10-28T19:58:40.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'bf211d46551079e7f7646ffd6bfda065f1307ea81508d1625b5c65005d929cb3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf0-2a08-4075-8ad6-465a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:40.000Z",
|
|
"modified": "2016-10-28T19:58:40.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '695e8149fcc44529d1bac1d43424689bad247481eb1fac396f4655680f18c421']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf1-b894-4532-9664-4f9402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:41.000Z",
|
|
"modified": "2016-10-28T19:58:41.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '27a3e90f99b53281a955d77e2c90723471e96163612bb8dc7e42ca8ee04a61dc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf2-7f80-4f35-a397-4a5402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:42.000Z",
|
|
"modified": "2016-10-28T19:58:42.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '7ff5625fc9eb5b9541392e93fff9fc60c801a1b4921f2bc367dcdaa42d364c6a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf2-283c-45d4-89fa-474002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:42.000Z",
|
|
"modified": "2016-10-28T19:58:42.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'dbc3f96fcbbfd90f877dc11fcdedca1c1e574b951ac70edc3160ed9f389c3fd3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf3-ef44-4052-bf4c-414702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:43.000Z",
|
|
"modified": "2016-10-28T19:58:43.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd3dec23f089a3b26919c0b2f35ff96c75d462fd97eb1e51937c616c4957482fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf4-3034-41f9-a4da-40db02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:44.000Z",
|
|
"modified": "2016-10-28T19:58:44.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '8a7c548a47c7cbd120b2f262797834e8aa8d6441082571f5d125c9a0ed4c75d4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf4-eccc-45a8-93de-432002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:44.000Z",
|
|
"modified": "2016-10-28T19:58:44.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '67a3b5d1fb946daccd7f3562e35b90537f9032184a0605cc9b8613c91a4ea1be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf5-04f8-4183-9b19-443802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:45.000Z",
|
|
"modified": "2016-10-28T19:58:45.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9bd1d3a567e2036f8e57745dd81333911b06a34f4ed6d7d68daa674aac0d7b96']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf5-b4b4-49dd-9bfa-47f302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:45.000Z",
|
|
"modified": "2016-10-28T19:58:45.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '08ab4abd017568142d061ffd5a2592a491730dddb4485211fda53f39d43e3efb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf6-b12c-4002-ba4b-489a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:46.000Z",
|
|
"modified": "2016-10-28T19:58:46.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '32c921dd4b755af519f648102098735a569a0326a79a911eb47174bd058e5c43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf7-bf0c-4f39-8483-4c0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:47.000Z",
|
|
"modified": "2016-10-28T19:58:47.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3dee377037f7fcfd6539c23bb1cdc6eda46680c8773525b784150c1237788965']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf7-dce8-4e82-bc96-4b1b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:47.000Z",
|
|
"modified": "2016-10-28T19:58:47.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '9f568df46838872b389628b665940415d897823b2e1804e2625c3dfb0b6850b4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf8-e488-4b31-8595-4f8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:48.000Z",
|
|
"modified": "2016-10-28T19:58:48.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '07dd2c7be7a0becb178967c43684c1a687deb217e87575d18fd6b73dc988bd78']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf9-7dc8-40ae-9a8a-4e0402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:49.000Z",
|
|
"modified": "2016-10-28T19:58:49.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'f7bc5d56312ae6205b21aa4c72708383716907754b037013f47bc88203fbb450']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adf9-98f0-4c42-ba5c-407602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:49.000Z",
|
|
"modified": "2016-10-28T19:58:49.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '3488881b691c8a821e97e42521289550cad4f350335fcdeeb87bcb40e9398357']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfa-ad3c-4f7f-8e66-4a2502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:50.000Z",
|
|
"modified": "2016-10-28T19:58:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '2668192417516bb2ec4d9808d8a781595564fb0253ca9d3912b667074c6ca6b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfa-9060-4b8c-a1cd-473802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:50.000Z",
|
|
"modified": "2016-10-28T19:58:50.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '22a578f2d30f316d441b73efbeaa0b53641686d2fa75ad44d4d3992da9ceaf5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfb-79d8-408f-b23d-450702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:51.000Z",
|
|
"modified": "2016-10-28T19:58:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'c79d7b2a8caf5cc19a019772053c54d1ec02f8ae15b577bbbbd9bf82f19caedb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfb-72dc-4deb-82ad-494702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:51.000Z",
|
|
"modified": "2016-10-28T19:58:51.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'b67570b16cc22a121554a37b238447731140f90751095f2990704756c4866351']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfc-bdf8-489e-b5db-4af802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:52.000Z",
|
|
"modified": "2016-10-28T19:58:52.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '68206d74a1011e9dcaec84be471e3fa9b6a4e5f512772c00f2f990624f8f681b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfc-20dc-45cc-95a6-4f0e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:52.000Z",
|
|
"modified": "2016-10-28T19:58:52.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '339eaabda43fbf0ee0caa6021a999d383713498911523d2b21e2ee2f1541f78f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfd-32dc-4035-93ed-41d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:53.000Z",
|
|
"modified": "2016-10-28T19:58:53.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'd47999ff9a33481be6ec1a6443c9a359662bf17f8aeadcb8ae9dac781be52d90']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfd-f2fc-4793-afa2-41bc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:53.000Z",
|
|
"modified": "2016-10-28T19:58:53.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'bf1f82ee300fa15a07ca02da78b1ed649877e38a613651377642b86dd0dbb40a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfe-ba54-4581-b069-4b6302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:54.000Z",
|
|
"modified": "2016-10-28T19:58:54.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = '0e8be50f0ad59239599eaceb7a6e30cc5909d401b2ff784e670ddecca1bc29d0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813adfe-a52c-4ff8-afae-493902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:58:54.000Z",
|
|
"modified": "2016-10-28T19:58:54.000Z",
|
|
"description": "List of hashes (unpacked version only)",
|
|
"pattern": "[file:hashes.SHA256 = 'ac36c87cacbe1b8327fae3084ebd1740a3a5c6c6f208c1c77da56932a9ca3be6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:58:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813ae0d-8248-44f8-8f23-4b1302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T19:59:09.000Z",
|
|
"modified": "2016-10-28T19:59:09.000Z",
|
|
"pattern": "[rule Rex {\r\n meta:\r\n description = \"Quick and dirty rule for Rex malware\"\r\n author = \"Benkow_@Stormshield\"\r\n strings:\r\n $string1= {6d 61 69 6e 2e 67 6f}\r\n $string2 = {72 65 78}\r\n $string3= {64 72 75 70 61 6c}\r\n condition:\r\n all of them\r\n}]",
|
|
"pattern_type": "yara",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T19:59:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"yara\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aebd-251c-40a7-94f8-436e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:05.000Z",
|
|
"modified": "2016-10-28T20:02:05.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ac36c87cacbe1b8327fae3084ebd1740a3a5c6c6f208c1c77da56932a9ca3be6",
|
|
"pattern": "[file:hashes.SHA1 = '28ab6b2fb6011688593d22ada78ebff098467415']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aebd-1904-4098-b439-4c8f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:05.000Z",
|
|
"modified": "2016-10-28T20:02:05.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ac36c87cacbe1b8327fae3084ebd1740a3a5c6c6f208c1c77da56932a9ca3be6",
|
|
"pattern": "[file:hashes.MD5 = '1b9b87630049af66d3ce27d022dcad0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aebe-1658-4184-8f41-4f6a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:06.000Z",
|
|
"modified": "2016-10-28T20:02:06.000Z",
|
|
"first_observed": "2016-10-28T20:02:06Z",
|
|
"last_observed": "2016-10-28T20:02:06Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aebe-1658-4184-8f41-4f6a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aebe-1658-4184-8f41-4f6a02de0b81",
|
|
"value": "https://www.virustotal.com/file/ac36c87cacbe1b8327fae3084ebd1740a3a5c6c6f208c1c77da56932a9ca3be6/analysis/1472712431/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aebe-d88c-40e9-8879-45ca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:06.000Z",
|
|
"modified": "2016-10-28T20:02:06.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0e8be50f0ad59239599eaceb7a6e30cc5909d401b2ff784e670ddecca1bc29d0",
|
|
"pattern": "[file:hashes.SHA1 = 'd7330e730f78f0b7e07c465ff19684a6616b7c12']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aebf-42ec-4f3f-a01c-49c402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:07.000Z",
|
|
"modified": "2016-10-28T20:02:07.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0e8be50f0ad59239599eaceb7a6e30cc5909d401b2ff784e670ddecca1bc29d0",
|
|
"pattern": "[file:hashes.MD5 = 'a22dfa9e4dfe97b9ede4d677de74a1b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aebf-677c-4eca-9842-4e5902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:07.000Z",
|
|
"modified": "2016-10-28T20:02:07.000Z",
|
|
"first_observed": "2016-10-28T20:02:07Z",
|
|
"last_observed": "2016-10-28T20:02:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aebf-677c-4eca-9842-4e5902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aebf-677c-4eca-9842-4e5902de0b81",
|
|
"value": "https://www.virustotal.com/file/0e8be50f0ad59239599eaceb7a6e30cc5909d401b2ff784e670ddecca1bc29d0/analysis/1472711997/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec0-d1a8-4ca0-b209-437a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:08.000Z",
|
|
"modified": "2016-10-28T20:02:08.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: bf1f82ee300fa15a07ca02da78b1ed649877e38a613651377642b86dd0dbb40a",
|
|
"pattern": "[file:hashes.SHA1 = '776146d17c6973b02fe4018d9ce8bd76b9658fda']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec0-baa0-4022-b0d5-4f2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:08.000Z",
|
|
"modified": "2016-10-28T20:02:08.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: bf1f82ee300fa15a07ca02da78b1ed649877e38a613651377642b86dd0dbb40a",
|
|
"pattern": "[file:hashes.MD5 = '140720cf5ab52b22c36f04782d877ee1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec1-a4d0-4544-a1ed-4ced02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:09.000Z",
|
|
"modified": "2016-10-28T20:02:09.000Z",
|
|
"first_observed": "2016-10-28T20:02:09Z",
|
|
"last_observed": "2016-10-28T20:02:09Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec1-a4d0-4544-a1ed-4ced02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec1-a4d0-4544-a1ed-4ced02de0b81",
|
|
"value": "https://www.virustotal.com/file/bf1f82ee300fa15a07ca02da78b1ed649877e38a613651377642b86dd0dbb40a/analysis/1476618622/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec1-c810-4196-90ec-4f4702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:09.000Z",
|
|
"modified": "2016-10-28T20:02:09.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d47999ff9a33481be6ec1a6443c9a359662bf17f8aeadcb8ae9dac781be52d90",
|
|
"pattern": "[file:hashes.SHA1 = '9e478aa7e2686ec14eed9aa1b82890e6ae534b60']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec2-e3a4-42df-8eaa-4f7202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:10.000Z",
|
|
"modified": "2016-10-28T20:02:10.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d47999ff9a33481be6ec1a6443c9a359662bf17f8aeadcb8ae9dac781be52d90",
|
|
"pattern": "[file:hashes.MD5 = 'bb08fcb7236f4fbcef129c3cc9dd4fc8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec2-9858-44c5-8fed-46a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:10.000Z",
|
|
"modified": "2016-10-28T20:02:10.000Z",
|
|
"first_observed": "2016-10-28T20:02:10Z",
|
|
"last_observed": "2016-10-28T20:02:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec2-9858-44c5-8fed-46a802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec2-9858-44c5-8fed-46a802de0b81",
|
|
"value": "https://www.virustotal.com/file/d47999ff9a33481be6ec1a6443c9a359662bf17f8aeadcb8ae9dac781be52d90/analysis/1476618797/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec3-39bc-4bf4-a108-497202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:11.000Z",
|
|
"modified": "2016-10-28T20:02:11.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 339eaabda43fbf0ee0caa6021a999d383713498911523d2b21e2ee2f1541f78f",
|
|
"pattern": "[file:hashes.SHA1 = 'e5070e160c5e4ecb1c763fa616f4c8484316f09c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec3-f708-4ed4-bc25-444002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:11.000Z",
|
|
"modified": "2016-10-28T20:02:11.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 339eaabda43fbf0ee0caa6021a999d383713498911523d2b21e2ee2f1541f78f",
|
|
"pattern": "[file:hashes.MD5 = '9bd6195f67c16764a5b7799ae187f85d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec4-2700-488b-9a4c-45f302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:12.000Z",
|
|
"modified": "2016-10-28T20:02:12.000Z",
|
|
"first_observed": "2016-10-28T20:02:12Z",
|
|
"last_observed": "2016-10-28T20:02:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec4-2700-488b-9a4c-45f302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec4-2700-488b-9a4c-45f302de0b81",
|
|
"value": "https://www.virustotal.com/file/339eaabda43fbf0ee0caa6021a999d383713498911523d2b21e2ee2f1541f78f/analysis/1472712489/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec5-9f2c-4881-bd55-456302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:13.000Z",
|
|
"modified": "2016-10-28T20:02:13.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 68206d74a1011e9dcaec84be471e3fa9b6a4e5f512772c00f2f990624f8f681b",
|
|
"pattern": "[file:hashes.SHA1 = 'f2ab2cb3f8ed134258fa0c2ccafe9db686961d09']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec5-8e1c-4e84-876f-4c4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:13.000Z",
|
|
"modified": "2016-10-28T20:02:13.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 68206d74a1011e9dcaec84be471e3fa9b6a4e5f512772c00f2f990624f8f681b",
|
|
"pattern": "[file:hashes.MD5 = 'e32429ee5451b88151e9430bcf8ae985']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec6-dbfc-4b28-a794-44bc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:14.000Z",
|
|
"modified": "2016-10-28T20:02:14.000Z",
|
|
"first_observed": "2016-10-28T20:02:14Z",
|
|
"last_observed": "2016-10-28T20:02:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec6-dbfc-4b28-a794-44bc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec6-dbfc-4b28-a794-44bc02de0b81",
|
|
"value": "https://www.virustotal.com/file/68206d74a1011e9dcaec84be471e3fa9b6a4e5f512772c00f2f990624f8f681b/analysis/1476619931/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec6-03a8-4bdf-8dd7-4b0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:14.000Z",
|
|
"modified": "2016-10-28T20:02:14.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b67570b16cc22a121554a37b238447731140f90751095f2990704756c4866351",
|
|
"pattern": "[file:hashes.SHA1 = '7e39c4501f6d56fa1cd5620b4327bc7283e498fe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec7-7eb4-4691-9da1-4d0b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:15.000Z",
|
|
"modified": "2016-10-28T20:02:15.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b67570b16cc22a121554a37b238447731140f90751095f2990704756c4866351",
|
|
"pattern": "[file:hashes.MD5 = 'c4c3a62cd4670465934dfdc777d4e17d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec7-6390-4cb8-a043-495102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:15.000Z",
|
|
"modified": "2016-10-28T20:02:15.000Z",
|
|
"first_observed": "2016-10-28T20:02:15Z",
|
|
"last_observed": "2016-10-28T20:02:15Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec7-6390-4cb8-a043-495102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec7-6390-4cb8-a043-495102de0b81",
|
|
"value": "https://www.virustotal.com/file/b67570b16cc22a121554a37b238447731140f90751095f2990704756c4866351/analysis/1476618984/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec8-5674-4ecf-af11-45da02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:16.000Z",
|
|
"modified": "2016-10-28T20:02:16.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c79d7b2a8caf5cc19a019772053c54d1ec02f8ae15b577bbbbd9bf82f19caedb",
|
|
"pattern": "[file:hashes.SHA1 = 'd9b872956a917823335fbdcd3c2254e46c851723']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec8-37b4-460d-837e-4bd602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:16.000Z",
|
|
"modified": "2016-10-28T20:02:16.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c79d7b2a8caf5cc19a019772053c54d1ec02f8ae15b577bbbbd9bf82f19caedb",
|
|
"pattern": "[file:hashes.MD5 = 'ea6cf7b6dd9c4c3df17fdda4eced84fc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aec9-05b0-44c1-8a02-484802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:17.000Z",
|
|
"modified": "2016-10-28T20:02:17.000Z",
|
|
"first_observed": "2016-10-28T20:02:17Z",
|
|
"last_observed": "2016-10-28T20:02:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aec9-05b0-44c1-8a02-484802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aec9-05b0-44c1-8a02-484802de0b81",
|
|
"value": "https://www.virustotal.com/file/c79d7b2a8caf5cc19a019772053c54d1ec02f8ae15b577bbbbd9bf82f19caedb/analysis/1472712479/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aec9-b79c-4245-aa05-4c3802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:17.000Z",
|
|
"modified": "2016-10-28T20:02:17.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 22a578f2d30f316d441b73efbeaa0b53641686d2fa75ad44d4d3992da9ceaf5f",
|
|
"pattern": "[file:hashes.SHA1 = '3f01cdbd14c0e232e4e7ff51dabe311266db8f17']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeca-073c-4a61-97b0-49e702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:18.000Z",
|
|
"modified": "2016-10-28T20:02:18.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 22a578f2d30f316d441b73efbeaa0b53641686d2fa75ad44d4d3992da9ceaf5f",
|
|
"pattern": "[file:hashes.MD5 = '299193c6f7dd582c6018b0f6f7e7857d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeca-9d54-4427-8581-412b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:18.000Z",
|
|
"modified": "2016-10-28T20:02:18.000Z",
|
|
"first_observed": "2016-10-28T20:02:18Z",
|
|
"last_observed": "2016-10-28T20:02:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeca-9d54-4427-8581-412b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeca-9d54-4427-8581-412b02de0b81",
|
|
"value": "https://www.virustotal.com/file/22a578f2d30f316d441b73efbeaa0b53641686d2fa75ad44d4d3992da9ceaf5f/analysis/1472712523/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aecb-d84c-45e8-b18f-43cd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:19.000Z",
|
|
"modified": "2016-10-28T20:02:19.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2668192417516bb2ec4d9808d8a781595564fb0253ca9d3912b667074c6ca6b9",
|
|
"pattern": "[file:hashes.SHA1 = 'a1190648b227950650566e787dc3324194765d7d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aecb-8888-4c4e-bcaa-43b502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:19.000Z",
|
|
"modified": "2016-10-28T20:02:19.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2668192417516bb2ec4d9808d8a781595564fb0253ca9d3912b667074c6ca6b9",
|
|
"pattern": "[file:hashes.MD5 = '1d09000f9c7af81d6eb8e5d4d7c5f139']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aecc-6d38-4d79-8178-47ab02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:20.000Z",
|
|
"modified": "2016-10-28T20:02:20.000Z",
|
|
"first_observed": "2016-10-28T20:02:20Z",
|
|
"last_observed": "2016-10-28T20:02:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aecc-6d38-4d79-8178-47ab02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aecc-6d38-4d79-8178-47ab02de0b81",
|
|
"value": "https://www.virustotal.com/file/2668192417516bb2ec4d9808d8a781595564fb0253ca9d3912b667074c6ca6b9/analysis/1472712727/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aecc-82ec-42dc-b68d-4a1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:20.000Z",
|
|
"modified": "2016-10-28T20:02:20.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3488881b691c8a821e97e42521289550cad4f350335fcdeeb87bcb40e9398357",
|
|
"pattern": "[file:hashes.SHA1 = '761ed01ca4a1e79e20c43533616030f4b680eea6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aecd-a1fc-4a44-94c8-441202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:21.000Z",
|
|
"modified": "2016-10-28T20:02:21.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3488881b691c8a821e97e42521289550cad4f350335fcdeeb87bcb40e9398357",
|
|
"pattern": "[file:hashes.MD5 = '8b64c5bebed5f5566472ad2fd4621888']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aecd-3d44-4e94-b1e5-466f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:21.000Z",
|
|
"modified": "2016-10-28T20:02:21.000Z",
|
|
"first_observed": "2016-10-28T20:02:21Z",
|
|
"last_observed": "2016-10-28T20:02:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aecd-3d44-4e94-b1e5-466f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aecd-3d44-4e94-b1e5-466f02de0b81",
|
|
"value": "https://www.virustotal.com/file/3488881b691c8a821e97e42521289550cad4f350335fcdeeb87bcb40e9398357/analysis/1476617114/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aece-e0bc-4fb1-abd7-42ca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:22.000Z",
|
|
"modified": "2016-10-28T20:02:22.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f7bc5d56312ae6205b21aa4c72708383716907754b037013f47bc88203fbb450",
|
|
"pattern": "[file:hashes.SHA1 = '00c33a1c304682538dd4f75a66fcd18b5d1661b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aece-ed78-47bc-8c4f-40a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:22.000Z",
|
|
"modified": "2016-10-28T20:02:22.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f7bc5d56312ae6205b21aa4c72708383716907754b037013f47bc88203fbb450",
|
|
"pattern": "[file:hashes.MD5 = 'a95547ade3f49fdcc96b6c72a0030bcc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aecf-3a78-4509-87f7-44b102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:23.000Z",
|
|
"modified": "2016-10-28T20:02:23.000Z",
|
|
"first_observed": "2016-10-28T20:02:23Z",
|
|
"last_observed": "2016-10-28T20:02:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aecf-3a78-4509-87f7-44b102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aecf-3a78-4509-87f7-44b102de0b81",
|
|
"value": "https://www.virustotal.com/file/f7bc5d56312ae6205b21aa4c72708383716907754b037013f47bc88203fbb450/analysis/1472712452/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed0-6c20-435b-be76-4c6e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:24.000Z",
|
|
"modified": "2016-10-28T20:02:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 07dd2c7be7a0becb178967c43684c1a687deb217e87575d18fd6b73dc988bd78",
|
|
"pattern": "[file:hashes.SHA1 = '4e40fa5f57d4a61c6016c21eee0dc302ee9d3cc7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed0-1c50-4882-a735-432902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:24.000Z",
|
|
"modified": "2016-10-28T20:02:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 07dd2c7be7a0becb178967c43684c1a687deb217e87575d18fd6b73dc988bd78",
|
|
"pattern": "[file:hashes.MD5 = '2f1ac9f071b0c8f0c1e8eb964727279b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed1-8428-49b0-bb3b-49d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:25.000Z",
|
|
"modified": "2016-10-28T20:02:25.000Z",
|
|
"first_observed": "2016-10-28T20:02:25Z",
|
|
"last_observed": "2016-10-28T20:02:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed1-8428-49b0-bb3b-49d802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed1-8428-49b0-bb3b-49d802de0b81",
|
|
"value": "https://www.virustotal.com/file/07dd2c7be7a0becb178967c43684c1a687deb217e87575d18fd6b73dc988bd78/analysis/1472712455/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed1-cf08-49f9-a6c7-42a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:25.000Z",
|
|
"modified": "2016-10-28T20:02:25.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9f568df46838872b389628b665940415d897823b2e1804e2625c3dfb0b6850b4",
|
|
"pattern": "[file:hashes.SHA1 = '9066892fee2cfbf12ddb0e3f356ed9c4882c58fe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed2-6b94-43f7-beea-446e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:26.000Z",
|
|
"modified": "2016-10-28T20:02:26.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9f568df46838872b389628b665940415d897823b2e1804e2625c3dfb0b6850b4",
|
|
"pattern": "[file:hashes.MD5 = 'ab6723643832bfe712a8d30d5fba828c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed2-0694-4250-89c2-499702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:26.000Z",
|
|
"modified": "2016-10-28T20:02:26.000Z",
|
|
"first_observed": "2016-10-28T20:02:26Z",
|
|
"last_observed": "2016-10-28T20:02:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed2-0694-4250-89c2-499702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed2-0694-4250-89c2-499702de0b81",
|
|
"value": "https://www.virustotal.com/file/9f568df46838872b389628b665940415d897823b2e1804e2625c3dfb0b6850b4/analysis/1472712601/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed3-15f8-4c9b-970d-4a1302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:27.000Z",
|
|
"modified": "2016-10-28T20:02:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3dee377037f7fcfd6539c23bb1cdc6eda46680c8773525b784150c1237788965",
|
|
"pattern": "[file:hashes.SHA1 = '32616d57e2218a358f56fb6853264af8148d4c14']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed3-a058-4082-8896-4b9b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:27.000Z",
|
|
"modified": "2016-10-28T20:02:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3dee377037f7fcfd6539c23bb1cdc6eda46680c8773525b784150c1237788965",
|
|
"pattern": "[file:hashes.MD5 = '35982e878042354d26ea69bb6506a259']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed4-cdd8-4005-8197-4f8c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:28.000Z",
|
|
"modified": "2016-10-28T20:02:28.000Z",
|
|
"first_observed": "2016-10-28T20:02:28Z",
|
|
"last_observed": "2016-10-28T20:02:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed4-cdd8-4005-8197-4f8c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed4-cdd8-4005-8197-4f8c02de0b81",
|
|
"value": "https://www.virustotal.com/file/3dee377037f7fcfd6539c23bb1cdc6eda46680c8773525b784150c1237788965/analysis/1472712472/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed4-c13c-49f2-8224-47a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:28.000Z",
|
|
"modified": "2016-10-28T20:02:28.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 32c921dd4b755af519f648102098735a569a0326a79a911eb47174bd058e5c43",
|
|
"pattern": "[file:hashes.SHA1 = 'dee0915500eaeab59f877eb4374cad81239da9a7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed5-c990-4a3a-b8d0-44ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:29.000Z",
|
|
"modified": "2016-10-28T20:02:29.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 32c921dd4b755af519f648102098735a569a0326a79a911eb47174bd058e5c43",
|
|
"pattern": "[file:hashes.MD5 = 'ab76cd7b1022d454275383d6990e1aec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed5-a520-400e-a38e-4e0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:29.000Z",
|
|
"modified": "2016-10-28T20:02:29.000Z",
|
|
"first_observed": "2016-10-28T20:02:29Z",
|
|
"last_observed": "2016-10-28T20:02:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed5-a520-400e-a38e-4e0f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed5-a520-400e-a38e-4e0f02de0b81",
|
|
"value": "https://www.virustotal.com/file/32c921dd4b755af519f648102098735a569a0326a79a911eb47174bd058e5c43/analysis/1472712492/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed6-cee0-4024-ac95-48fc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:30.000Z",
|
|
"modified": "2016-10-28T20:02:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 08ab4abd017568142d061ffd5a2592a491730dddb4485211fda53f39d43e3efb",
|
|
"pattern": "[file:hashes.SHA1 = 'c7418b901fda548b7f888b352c7585e39c320f92']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed6-a0b8-4f92-845d-49cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:30.000Z",
|
|
"modified": "2016-10-28T20:02:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 08ab4abd017568142d061ffd5a2592a491730dddb4485211fda53f39d43e3efb",
|
|
"pattern": "[file:hashes.MD5 = 'c67ded3cf431cfdbf2360c9f95ca286a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed7-1ef8-4d60-8bd1-4d5202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:31.000Z",
|
|
"modified": "2016-10-28T20:02:31.000Z",
|
|
"first_observed": "2016-10-28T20:02:31Z",
|
|
"last_observed": "2016-10-28T20:02:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed7-1ef8-4d60-8bd1-4d5202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed7-1ef8-4d60-8bd1-4d5202de0b81",
|
|
"value": "https://www.virustotal.com/file/08ab4abd017568142d061ffd5a2592a491730dddb4485211fda53f39d43e3efb/analysis/1472712622/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed7-6960-462d-8677-43dc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:31.000Z",
|
|
"modified": "2016-10-28T20:02:31.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9bd1d3a567e2036f8e57745dd81333911b06a34f4ed6d7d68daa674aac0d7b96",
|
|
"pattern": "[file:hashes.SHA1 = 'ee7cc9484d9d0534ad2f61d90fc0cd4bf67b782e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed8-5604-4510-9ec1-46a602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:32.000Z",
|
|
"modified": "2016-10-28T20:02:32.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9bd1d3a567e2036f8e57745dd81333911b06a34f4ed6d7d68daa674aac0d7b96",
|
|
"pattern": "[file:hashes.MD5 = '99968719931f5ad719c5b84e68aecad5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aed8-3718-4b56-9cf0-4ef302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:32.000Z",
|
|
"modified": "2016-10-28T20:02:32.000Z",
|
|
"first_observed": "2016-10-28T20:02:32Z",
|
|
"last_observed": "2016-10-28T20:02:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aed8-3718-4b56-9cf0-4ef302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aed8-3718-4b56-9cf0-4ef302de0b81",
|
|
"value": "https://www.virustotal.com/file/9bd1d3a567e2036f8e57745dd81333911b06a34f4ed6d7d68daa674aac0d7b96/analysis/1473423286/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed9-6374-4adb-a958-4bb102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:33.000Z",
|
|
"modified": "2016-10-28T20:02:33.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 67a3b5d1fb946daccd7f3562e35b90537f9032184a0605cc9b8613c91a4ea1be",
|
|
"pattern": "[file:hashes.SHA1 = '38e862645295b268d30f34978ebb65fba787343f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aed9-20bc-4fba-a56a-460a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:33.000Z",
|
|
"modified": "2016-10-28T20:02:33.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 67a3b5d1fb946daccd7f3562e35b90537f9032184a0605cc9b8613c91a4ea1be",
|
|
"pattern": "[file:hashes.MD5 = '7ce450337d2ed3f6b14518076f2e76c6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeda-fed0-42d9-bc7d-448102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:34.000Z",
|
|
"modified": "2016-10-28T20:02:34.000Z",
|
|
"first_observed": "2016-10-28T20:02:34Z",
|
|
"last_observed": "2016-10-28T20:02:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeda-fed0-42d9-bc7d-448102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeda-fed0-42d9-bc7d-448102de0b81",
|
|
"value": "https://www.virustotal.com/file/67a3b5d1fb946daccd7f3562e35b90537f9032184a0605cc9b8613c91a4ea1be/analysis/1472712851/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeda-81bc-4b31-9848-4e1f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:34.000Z",
|
|
"modified": "2016-10-28T20:02:34.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8a7c548a47c7cbd120b2f262797834e8aa8d6441082571f5d125c9a0ed4c75d4",
|
|
"pattern": "[file:hashes.SHA1 = '2c514212637e9d8d8861de4efd4a0062831f75d5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedb-4fc4-491e-9999-405002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:35.000Z",
|
|
"modified": "2016-10-28T20:02:35.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8a7c548a47c7cbd120b2f262797834e8aa8d6441082571f5d125c9a0ed4c75d4",
|
|
"pattern": "[file:hashes.MD5 = '33ec152761d37a349433572df4b6dfc7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aedb-b0d0-4e2f-ade4-436b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:35.000Z",
|
|
"modified": "2016-10-28T20:02:35.000Z",
|
|
"first_observed": "2016-10-28T20:02:35Z",
|
|
"last_observed": "2016-10-28T20:02:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aedb-b0d0-4e2f-ade4-436b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aedb-b0d0-4e2f-ade4-436b02de0b81",
|
|
"value": "https://www.virustotal.com/file/8a7c548a47c7cbd120b2f262797834e8aa8d6441082571f5d125c9a0ed4c75d4/analysis/1474010596/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedc-d48c-4e64-95ab-494502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:36.000Z",
|
|
"modified": "2016-10-28T20:02:36.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d3dec23f089a3b26919c0b2f35ff96c75d462fd97eb1e51937c616c4957482fd",
|
|
"pattern": "[file:hashes.SHA1 = 'ae5168fb202135d084ab079cb4bca1d842fc8d28']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedc-61d0-42be-a7d5-4c5c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:36.000Z",
|
|
"modified": "2016-10-28T20:02:36.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d3dec23f089a3b26919c0b2f35ff96c75d462fd97eb1e51937c616c4957482fd",
|
|
"pattern": "[file:hashes.MD5 = 'a28ed4be70dba68becce9bde5b1f1a67']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aedd-e830-429f-ba53-43ac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:37.000Z",
|
|
"modified": "2016-10-28T20:02:37.000Z",
|
|
"first_observed": "2016-10-28T20:02:37Z",
|
|
"last_observed": "2016-10-28T20:02:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aedd-e830-429f-ba53-43ac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aedd-e830-429f-ba53-43ac02de0b81",
|
|
"value": "https://www.virustotal.com/file/d3dec23f089a3b26919c0b2f35ff96c75d462fd97eb1e51937c616c4957482fd/analysis/1476620471/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedd-69b8-45b2-b866-4b9b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:37.000Z",
|
|
"modified": "2016-10-28T20:02:37.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dbc3f96fcbbfd90f877dc11fcdedca1c1e574b951ac70edc3160ed9f389c3fd3",
|
|
"pattern": "[file:hashes.SHA1 = 'bc7f77d3d5401aadd2ad9934f19abc1ccf4f95fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aede-2f44-46e1-af9d-410302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:38.000Z",
|
|
"modified": "2016-10-28T20:02:38.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dbc3f96fcbbfd90f877dc11fcdedca1c1e574b951ac70edc3160ed9f389c3fd3",
|
|
"pattern": "[file:hashes.MD5 = '6b0a330d0ab9e78ed16875220b01d969']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aede-9de8-4947-9889-4b0602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:38.000Z",
|
|
"modified": "2016-10-28T20:02:38.000Z",
|
|
"first_observed": "2016-10-28T20:02:38Z",
|
|
"last_observed": "2016-10-28T20:02:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aede-9de8-4947-9889-4b0602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aede-9de8-4947-9889-4b0602de0b81",
|
|
"value": "https://www.virustotal.com/file/dbc3f96fcbbfd90f877dc11fcdedca1c1e574b951ac70edc3160ed9f389c3fd3/analysis/1472712518/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedf-3ae8-4407-b4a9-49e602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:39.000Z",
|
|
"modified": "2016-10-28T20:02:39.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7ff5625fc9eb5b9541392e93fff9fc60c801a1b4921f2bc367dcdaa42d364c6a",
|
|
"pattern": "[file:hashes.SHA1 = '2288a498bd7748b5d2947e33c2f7c7ebf81472c4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aedf-f060-44a2-a2c1-449702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:39.000Z",
|
|
"modified": "2016-10-28T20:02:39.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7ff5625fc9eb5b9541392e93fff9fc60c801a1b4921f2bc367dcdaa42d364c6a",
|
|
"pattern": "[file:hashes.MD5 = 'fafbb42edee68da248ece92f519401ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee0-a344-4f12-8d24-42ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:40.000Z",
|
|
"modified": "2016-10-28T20:02:40.000Z",
|
|
"first_observed": "2016-10-28T20:02:40Z",
|
|
"last_observed": "2016-10-28T20:02:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee0-a344-4f12-8d24-42ff02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee0-a344-4f12-8d24-42ff02de0b81",
|
|
"value": "https://www.virustotal.com/file/7ff5625fc9eb5b9541392e93fff9fc60c801a1b4921f2bc367dcdaa42d364c6a/analysis/1474389934/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee0-0ffc-4e24-94f5-4d8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:40.000Z",
|
|
"modified": "2016-10-28T20:02:40.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 27a3e90f99b53281a955d77e2c90723471e96163612bb8dc7e42ca8ee04a61dc",
|
|
"pattern": "[file:hashes.SHA1 = '2057cd7e12ffab69a6b36b8b24019257850fe01f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee1-60fc-4abd-9108-403c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:41.000Z",
|
|
"modified": "2016-10-28T20:02:41.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 27a3e90f99b53281a955d77e2c90723471e96163612bb8dc7e42ca8ee04a61dc",
|
|
"pattern": "[file:hashes.MD5 = '8c339fa265e3c36bb8d9d6bcf135703f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee1-63b8-4155-bbaa-4b8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:41.000Z",
|
|
"modified": "2016-10-28T20:02:41.000Z",
|
|
"first_observed": "2016-10-28T20:02:41Z",
|
|
"last_observed": "2016-10-28T20:02:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee1-63b8-4155-bbaa-4b8802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee1-63b8-4155-bbaa-4b8802de0b81",
|
|
"value": "https://www.virustotal.com/file/27a3e90f99b53281a955d77e2c90723471e96163612bb8dc7e42ca8ee04a61dc/analysis/1472710117/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee2-cb2c-4e09-8e6f-41a802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:42.000Z",
|
|
"modified": "2016-10-28T20:02:42.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 695e8149fcc44529d1bac1d43424689bad247481eb1fac396f4655680f18c421",
|
|
"pattern": "[file:hashes.SHA1 = 'cbaa6ab19dc9daf1aa0652ffe6c905f4b635ecbc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee2-84a0-489c-b9a5-438702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:42.000Z",
|
|
"modified": "2016-10-28T20:02:42.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 695e8149fcc44529d1bac1d43424689bad247481eb1fac396f4655680f18c421",
|
|
"pattern": "[file:hashes.MD5 = '4f1e6ba530f24f4ec014fe91a160d23d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee3-814c-4282-8fd3-4dac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:43.000Z",
|
|
"modified": "2016-10-28T20:02:43.000Z",
|
|
"first_observed": "2016-10-28T20:02:43Z",
|
|
"last_observed": "2016-10-28T20:02:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee3-814c-4282-8fd3-4dac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee3-814c-4282-8fd3-4dac02de0b81",
|
|
"value": "https://www.virustotal.com/file/695e8149fcc44529d1bac1d43424689bad247481eb1fac396f4655680f18c421/analysis/1476619913/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee3-fbf8-4d91-a3cc-4be202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:43.000Z",
|
|
"modified": "2016-10-28T20:02:43.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1f4d876b17a6d786aa793b9c529235f9f9e164d70a74d8d26ca850d18f1329a7",
|
|
"pattern": "[file:hashes.SHA1 = 'bba051ec1d0c4b1ac6bc031aba5af5897cc82d16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee4-a660-421a-b7c5-407b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:44.000Z",
|
|
"modified": "2016-10-28T20:02:44.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1f4d876b17a6d786aa793b9c529235f9f9e164d70a74d8d26ca850d18f1329a7",
|
|
"pattern": "[file:hashes.MD5 = '6436a7a5d27ef2d19c2131f5238ffc60']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee4-25f8-4fd0-bbd5-455f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:44.000Z",
|
|
"modified": "2016-10-28T20:02:44.000Z",
|
|
"first_observed": "2016-10-28T20:02:44Z",
|
|
"last_observed": "2016-10-28T20:02:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee4-25f8-4fd0-bbd5-455f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee4-25f8-4fd0-bbd5-455f02de0b81",
|
|
"value": "https://www.virustotal.com/file/1f4d876b17a6d786aa793b9c529235f9f9e164d70a74d8d26ca850d18f1329a7/analysis/1472712528/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee5-ac54-4aad-be4e-48b002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:45.000Z",
|
|
"modified": "2016-10-28T20:02:45.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: e0a198d524b7cd6995d53a9e30a88072f866ae66ecde8f5e3f1fff204d3d8a49",
|
|
"pattern": "[file:hashes.SHA1 = '5248edf535d66f4eed12d9d233b8aa9ab231edbc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee5-5574-4540-b28d-4e6802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:45.000Z",
|
|
"modified": "2016-10-28T20:02:45.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: e0a198d524b7cd6995d53a9e30a88072f866ae66ecde8f5e3f1fff204d3d8a49",
|
|
"pattern": "[file:hashes.MD5 = '529f26aac8033cb633c24d74eac074c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee6-88a0-4598-a33e-4f8002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:46.000Z",
|
|
"modified": "2016-10-28T20:02:46.000Z",
|
|
"first_observed": "2016-10-28T20:02:46Z",
|
|
"last_observed": "2016-10-28T20:02:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee6-88a0-4598-a33e-4f8002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee6-88a0-4598-a33e-4f8002de0b81",
|
|
"value": "https://www.virustotal.com/file/e0a198d524b7cd6995d53a9e30a88072f866ae66ecde8f5e3f1fff204d3d8a49/analysis/1476618489/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee6-7c84-4cad-96bc-4cc302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:46.000Z",
|
|
"modified": "2016-10-28T20:02:46.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9583377cf54642118cee629e5b0fb3c708a46d584ce1e5e5121bded18e071e39",
|
|
"pattern": "[file:hashes.SHA1 = '38694601a4fa86dba04423aff9c76404153c16f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee7-563c-4e84-9ec6-4cf302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:47.000Z",
|
|
"modified": "2016-10-28T20:02:47.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9583377cf54642118cee629e5b0fb3c708a46d584ce1e5e5121bded18e071e39",
|
|
"pattern": "[file:hashes.MD5 = 'dd3a0734650b5338c13fe6d9f2cae220']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee7-7ae8-45af-821b-4c3602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:47.000Z",
|
|
"modified": "2016-10-28T20:02:47.000Z",
|
|
"first_observed": "2016-10-28T20:02:47Z",
|
|
"last_observed": "2016-10-28T20:02:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee7-7ae8-45af-821b-4c3602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee7-7ae8-45af-821b-4c3602de0b81",
|
|
"value": "https://www.virustotal.com/file/9583377cf54642118cee629e5b0fb3c708a46d584ce1e5e5121bded18e071e39/analysis/1476615247/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee8-0398-438d-bc3a-466702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:48.000Z",
|
|
"modified": "2016-10-28T20:02:48.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: daa738f9ebd1ef2899430efad81d2b870aa665a0cb322614e1880454d3215bf7",
|
|
"pattern": "[file:hashes.SHA1 = '0002efbbcbe0cf6427509300715b56f4cdede236']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee8-6200-4fec-bfd1-428102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:48.000Z",
|
|
"modified": "2016-10-28T20:02:48.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: daa738f9ebd1ef2899430efad81d2b870aa665a0cb322614e1880454d3215bf7",
|
|
"pattern": "[file:hashes.MD5 = 'acbbb7b8a241b02830dd32600a5f184c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aee9-4c34-4c18-b90a-471202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:49.000Z",
|
|
"modified": "2016-10-28T20:02:49.000Z",
|
|
"first_observed": "2016-10-28T20:02:49Z",
|
|
"last_observed": "2016-10-28T20:02:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aee9-4c34-4c18-b90a-471202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aee9-4c34-4c18-b90a-471202de0b81",
|
|
"value": "https://www.virustotal.com/file/daa738f9ebd1ef2899430efad81d2b870aa665a0cb322614e1880454d3215bf7/analysis/1476620054/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aee9-e26c-4863-838e-4ace02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:49.000Z",
|
|
"modified": "2016-10-28T20:02:49.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 91164673cda591a9a4dec91ecda6dbb515d48df7b56108b5fa0053395c733188",
|
|
"pattern": "[file:hashes.SHA1 = '51596075eb793de991f0555f76bb0717c2f1c978']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeea-c3ac-4cc4-9cc8-4e6002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:50.000Z",
|
|
"modified": "2016-10-28T20:02:50.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 91164673cda591a9a4dec91ecda6dbb515d48df7b56108b5fa0053395c733188",
|
|
"pattern": "[file:hashes.MD5 = '2d660e947062bd0d87ac61e5df26a812']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeea-b244-4abe-8bac-413002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:50.000Z",
|
|
"modified": "2016-10-28T20:02:50.000Z",
|
|
"first_observed": "2016-10-28T20:02:50Z",
|
|
"last_observed": "2016-10-28T20:02:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeea-b244-4abe-8bac-413002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeea-b244-4abe-8bac-413002de0b81",
|
|
"value": "https://www.virustotal.com/file/91164673cda591a9a4dec91ecda6dbb515d48df7b56108b5fa0053395c733188/analysis/1473167724/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeeb-dd44-466e-a272-486202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:51.000Z",
|
|
"modified": "2016-10-28T20:02:51.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 62b5b723195abc5c75ffb03707baf9261395b429359282a3dbd8c2f00f125028",
|
|
"pattern": "[file:hashes.SHA1 = '94b551b1caaa39b9b598dcdc68efb35d83b7c514']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeeb-c078-43c1-b569-431102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:51.000Z",
|
|
"modified": "2016-10-28T20:02:51.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 62b5b723195abc5c75ffb03707baf9261395b429359282a3dbd8c2f00f125028",
|
|
"pattern": "[file:hashes.MD5 = '69682a325400e8752c4dc5dbf5325f3c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeec-c058-4ebd-b58f-463802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:52.000Z",
|
|
"modified": "2016-10-28T20:02:52.000Z",
|
|
"first_observed": "2016-10-28T20:02:52Z",
|
|
"last_observed": "2016-10-28T20:02:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeec-c058-4ebd-b58f-463802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeec-c058-4ebd-b58f-463802de0b81",
|
|
"value": "https://www.virustotal.com/file/62b5b723195abc5c75ffb03707baf9261395b429359282a3dbd8c2f00f125028/analysis/1476619804/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeec-6b54-4806-ae25-4e2302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:52.000Z",
|
|
"modified": "2016-10-28T20:02:52.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: fe2c837d1662ca47ebd86c0cf0a3a382ee589bce6b77dabae30801d71a7d280f",
|
|
"pattern": "[file:hashes.SHA1 = '767f0750f9b75494bb16eaed1dc6beb5df5c914b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeed-3b14-4a4e-8284-460b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:53.000Z",
|
|
"modified": "2016-10-28T20:02:53.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: fe2c837d1662ca47ebd86c0cf0a3a382ee589bce6b77dabae30801d71a7d280f",
|
|
"pattern": "[file:hashes.MD5 = '96ee5cd95015e823b1e71e6863ddca32']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeed-75a8-44c4-bbe4-46a402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:53.000Z",
|
|
"modified": "2016-10-28T20:02:53.000Z",
|
|
"first_observed": "2016-10-28T20:02:53Z",
|
|
"last_observed": "2016-10-28T20:02:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeed-75a8-44c4-bbe4-46a402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeed-75a8-44c4-bbe4-46a402de0b81",
|
|
"value": "https://www.virustotal.com/file/fe2c837d1662ca47ebd86c0cf0a3a382ee589bce6b77dabae30801d71a7d280f/analysis/1472712546/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeee-bbec-4ee8-936a-418a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:54.000Z",
|
|
"modified": "2016-10-28T20:02:54.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: cc01ba0825208402b0fc2eb62146e856f69d1e9f53b745d8f068f0d09e6170c0",
|
|
"pattern": "[file:hashes.SHA1 = '475f45d3937176c0ba848afed318fbaa3303f73a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeef-13b0-449b-a517-484702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:55.000Z",
|
|
"modified": "2016-10-28T20:02:55.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: cc01ba0825208402b0fc2eb62146e856f69d1e9f53b745d8f068f0d09e6170c0",
|
|
"pattern": "[file:hashes.MD5 = '5dbfd0d04210b3ebb24c84042bfba547']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeef-d6d4-47d5-a100-422102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:55.000Z",
|
|
"modified": "2016-10-28T20:02:55.000Z",
|
|
"first_observed": "2016-10-28T20:02:55Z",
|
|
"last_observed": "2016-10-28T20:02:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeef-d6d4-47d5-a100-422102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeef-d6d4-47d5-a100-422102de0b81",
|
|
"value": "https://www.virustotal.com/file/cc01ba0825208402b0fc2eb62146e856f69d1e9f53b745d8f068f0d09e6170c0/analysis/1472712487/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef0-0aec-44b0-9154-4c0702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:56.000Z",
|
|
"modified": "2016-10-28T20:02:56.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f141e71e98e635dec4918854bfca84bf94e24bf0ce5d54c0a3802317d8790c14",
|
|
"pattern": "[file:hashes.SHA1 = 'ed26ce0b4b911121aeeb6ade54c1aee3c8746f4e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef0-4284-4d94-b801-45dd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:56.000Z",
|
|
"modified": "2016-10-28T20:02:56.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f141e71e98e635dec4918854bfca84bf94e24bf0ce5d54c0a3802317d8790c14",
|
|
"pattern": "[file:hashes.MD5 = '2b3dfa2352a8b5f96efa11bc6d4aee8c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef1-ab6c-453c-b13a-4a8602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:57.000Z",
|
|
"modified": "2016-10-28T20:02:57.000Z",
|
|
"first_observed": "2016-10-28T20:02:57Z",
|
|
"last_observed": "2016-10-28T20:02:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef1-ab6c-453c-b13a-4a8602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef1-ab6c-453c-b13a-4a8602de0b81",
|
|
"value": "https://www.virustotal.com/file/f141e71e98e635dec4918854bfca84bf94e24bf0ce5d54c0a3802317d8790c14/analysis/1476618750/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef1-e47c-445a-ba49-4d5202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:57.000Z",
|
|
"modified": "2016-10-28T20:02:57.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9070f56651f44ec722e17df67b8a954888e387a8f2574594c80937d0f39c471a",
|
|
"pattern": "[file:hashes.SHA1 = 'cf4035393e760c44a1c293fe511a8ab166d0283c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef2-b358-40d5-95a5-49ae02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:58.000Z",
|
|
"modified": "2016-10-28T20:02:58.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9070f56651f44ec722e17df67b8a954888e387a8f2574594c80937d0f39c471a",
|
|
"pattern": "[file:hashes.MD5 = '942699e2b6debfacec7ac278b947ce86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef2-a5cc-462e-96da-470902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:58.000Z",
|
|
"modified": "2016-10-28T20:02:58.000Z",
|
|
"first_observed": "2016-10-28T20:02:58Z",
|
|
"last_observed": "2016-10-28T20:02:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef2-a5cc-462e-96da-470902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef2-a5cc-462e-96da-470902de0b81",
|
|
"value": "https://www.virustotal.com/file/9070f56651f44ec722e17df67b8a954888e387a8f2574594c80937d0f39c471a/analysis/1472712574/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef2-08e4-4bb4-8c5b-41d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:58.000Z",
|
|
"modified": "2016-10-28T20:02:58.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a3dbdc19534e24be02c8bee896664e0de611410cd37b53445480e180ced4305f",
|
|
"pattern": "[file:hashes.SHA1 = 'ad9387f96cda29a09d9378d97b514b867cc0f352']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef3-7540-4479-9801-438802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:59.000Z",
|
|
"modified": "2016-10-28T20:02:59.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a3dbdc19534e24be02c8bee896664e0de611410cd37b53445480e180ced4305f",
|
|
"pattern": "[file:hashes.MD5 = '207aa559abc65ca1a7deec392b1a27df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:02:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef3-b990-442d-8184-4a1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:02:59.000Z",
|
|
"modified": "2016-10-28T20:02:59.000Z",
|
|
"first_observed": "2016-10-28T20:02:59Z",
|
|
"last_observed": "2016-10-28T20:02:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef3-b990-442d-8184-4a1602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef3-b990-442d-8184-4a1602de0b81",
|
|
"value": "https://www.virustotal.com/file/a3dbdc19534e24be02c8bee896664e0de611410cd37b53445480e180ced4305f/analysis/1474389910/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef4-1934-4e7a-981d-4ea802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:00.000Z",
|
|
"modified": "2016-10-28T20:03:00.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a76a5ee67521c74d72cb1e533edab048d9fa54e86dbdb65209b6d47295f59559",
|
|
"pattern": "[file:hashes.SHA1 = '419c22691260f3802bbfbfd1b27e9863eea2c140']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef4-53fc-404b-84e7-4ef902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:00.000Z",
|
|
"modified": "2016-10-28T20:03:00.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a76a5ee67521c74d72cb1e533edab048d9fa54e86dbdb65209b6d47295f59559",
|
|
"pattern": "[file:hashes.MD5 = '8b8aadec6a6012261f36fc123e39467f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef5-c120-4a1d-9358-400802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:01.000Z",
|
|
"modified": "2016-10-28T20:03:01.000Z",
|
|
"first_observed": "2016-10-28T20:03:01Z",
|
|
"last_observed": "2016-10-28T20:03:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef5-c120-4a1d-9358-400802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef5-c120-4a1d-9358-400802de0b81",
|
|
"value": "https://www.virustotal.com/file/a76a5ee67521c74d72cb1e533edab048d9fa54e86dbdb65209b6d47295f59559/analysis/1476617328/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef5-00ec-4946-a8ab-48e402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:01.000Z",
|
|
"modified": "2016-10-28T20:03:01.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d097f55f82e88a32b057010c96f553aa7c8ccef12c2a8484aab0fb3dab9d4a0f",
|
|
"pattern": "[file:hashes.SHA1 = 'f5fbac9efd268c323c34eb5c092b34adbfdd02a8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef6-c5b4-48a9-b48d-4b4802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:02.000Z",
|
|
"modified": "2016-10-28T20:03:02.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d097f55f82e88a32b057010c96f553aa7c8ccef12c2a8484aab0fb3dab9d4a0f",
|
|
"pattern": "[file:hashes.MD5 = '02872cf1685be0b62e66469eb81a1d7f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef6-2680-498d-b8ea-40cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:02.000Z",
|
|
"modified": "2016-10-28T20:03:02.000Z",
|
|
"first_observed": "2016-10-28T20:03:02Z",
|
|
"last_observed": "2016-10-28T20:03:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef6-2680-498d-b8ea-40cb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef6-2680-498d-b8ea-40cb02de0b81",
|
|
"value": "https://www.virustotal.com/file/d097f55f82e88a32b057010c96f553aa7c8ccef12c2a8484aab0fb3dab9d4a0f/analysis/1472712501/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef7-178c-40dc-8cc4-4a4f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:03.000Z",
|
|
"modified": "2016-10-28T20:03:03.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: efdb2de4f0534c1209222936d0973d2a0cc47e3b87a358718b0486da86676ce8",
|
|
"pattern": "[file:hashes.SHA1 = '865a4d2f7baa856cfbcd965f752ca4199653e427']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef7-a2ac-4bae-a86e-40d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:03.000Z",
|
|
"modified": "2016-10-28T20:03:03.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: efdb2de4f0534c1209222936d0973d2a0cc47e3b87a358718b0486da86676ce8",
|
|
"pattern": "[file:hashes.MD5 = '5b3f743f38b8988c64729ca9eb593662']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef8-291c-4bc0-a0e5-402a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:04.000Z",
|
|
"modified": "2016-10-28T20:03:04.000Z",
|
|
"first_observed": "2016-10-28T20:03:04Z",
|
|
"last_observed": "2016-10-28T20:03:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef8-291c-4bc0-a0e5-402a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef8-291c-4bc0-a0e5-402a02de0b81",
|
|
"value": "https://www.virustotal.com/file/efdb2de4f0534c1209222936d0973d2a0cc47e3b87a358718b0486da86676ce8/analysis/1476620457/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef8-6544-4842-b0ab-48bb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:04.000Z",
|
|
"modified": "2016-10-28T20:03:04.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 677464da2fcf73b9793daca3191501da02957af08a6471a047410ce99ea49405",
|
|
"pattern": "[file:hashes.SHA1 = 'fbea71e6960baf90f2930dc7ec180ff20adb3b6c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aef9-37e4-4e9d-9534-402602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:05.000Z",
|
|
"modified": "2016-10-28T20:03:05.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 677464da2fcf73b9793daca3191501da02957af08a6471a047410ce99ea49405",
|
|
"pattern": "[file:hashes.MD5 = 'd9bf742f0e295affee522041e29b20ec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aef9-50a4-4d75-9b43-48bb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:05.000Z",
|
|
"modified": "2016-10-28T20:03:05.000Z",
|
|
"first_observed": "2016-10-28T20:03:05Z",
|
|
"last_observed": "2016-10-28T20:03:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aef9-50a4-4d75-9b43-48bb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aef9-50a4-4d75-9b43-48bb02de0b81",
|
|
"value": "https://www.virustotal.com/file/677464da2fcf73b9793daca3191501da02957af08a6471a047410ce99ea49405/analysis/1472108652/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefa-f15c-4f16-8936-4dca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:06.000Z",
|
|
"modified": "2016-10-28T20:03:06.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: cb42573e36fb148bc1109229a1025cdcb375c166361605f0681da9e54e3ef81d",
|
|
"pattern": "[file:hashes.SHA1 = '9818acdd7bc627e2c87673b88dc16203908075a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefa-c9bc-425a-817f-447d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:06.000Z",
|
|
"modified": "2016-10-28T20:03:06.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: cb42573e36fb148bc1109229a1025cdcb375c166361605f0681da9e54e3ef81d",
|
|
"pattern": "[file:hashes.MD5 = '8590a0a0bb5649e018a379be0eaf298d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aefb-1a64-41de-9b74-42eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:07.000Z",
|
|
"modified": "2016-10-28T20:03:07.000Z",
|
|
"first_observed": "2016-10-28T20:03:07Z",
|
|
"last_observed": "2016-10-28T20:03:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aefb-1a64-41de-9b74-42eb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aefb-1a64-41de-9b74-42eb02de0b81",
|
|
"value": "https://www.virustotal.com/file/cb42573e36fb148bc1109229a1025cdcb375c166361605f0681da9e54e3ef81d/analysis/1472712486/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefb-89cc-41d8-a3e2-469702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:07.000Z",
|
|
"modified": "2016-10-28T20:03:07.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 5c8269ab600d6ccd73f5b57871300585cf034716e61dda019132b0ac8d20a954",
|
|
"pattern": "[file:hashes.SHA1 = '560f2d1ad1ea257e8b571d1bef13e1d68742765c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefc-e904-4de1-beeb-4e6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:08.000Z",
|
|
"modified": "2016-10-28T20:03:08.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 5c8269ab600d6ccd73f5b57871300585cf034716e61dda019132b0ac8d20a954",
|
|
"pattern": "[file:hashes.MD5 = 'd30b71d1eccdfa10f374043639642923']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aefc-6034-4b2e-8cfd-4b9a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:08.000Z",
|
|
"modified": "2016-10-28T20:03:08.000Z",
|
|
"first_observed": "2016-10-28T20:03:08Z",
|
|
"last_observed": "2016-10-28T20:03:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aefc-6034-4b2e-8cfd-4b9a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aefc-6034-4b2e-8cfd-4b9a02de0b81",
|
|
"value": "https://www.virustotal.com/file/5c8269ab600d6ccd73f5b57871300585cf034716e61dda019132b0ac8d20a954/analysis/1472713043/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefd-8778-4ce8-a9ae-48fa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:09.000Z",
|
|
"modified": "2016-10-28T20:03:09.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: afaa75870b6333fa4d4c4e337dc9a2e3d9cc4493599fa21b9ad4e50d802f98b5",
|
|
"pattern": "[file:hashes.SHA1 = '9f20bc6e6644bd3c05c32b61a6fae17070aad7cb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefd-0e04-4acd-a6da-406f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:09.000Z",
|
|
"modified": "2016-10-28T20:03:09.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: afaa75870b6333fa4d4c4e337dc9a2e3d9cc4493599fa21b9ad4e50d802f98b5",
|
|
"pattern": "[file:hashes.MD5 = '837667a5833c9be54a33df43365194fe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aefe-9714-4cd2-889c-4ae602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:10.000Z",
|
|
"modified": "2016-10-28T20:03:10.000Z",
|
|
"first_observed": "2016-10-28T20:03:10Z",
|
|
"last_observed": "2016-10-28T20:03:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aefe-9714-4cd2-889c-4ae602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aefe-9714-4cd2-889c-4ae602de0b81",
|
|
"value": "https://www.virustotal.com/file/afaa75870b6333fa4d4c4e337dc9a2e3d9cc4493599fa21b9ad4e50d802f98b5/analysis/1476617605/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aefe-5390-4aca-bf2d-4d8402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:10.000Z",
|
|
"modified": "2016-10-28T20:03:10.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4b513dfc68fe825e5f83c51fc1a023c15bf1039e48e025a0a4f4b034dbf443b9",
|
|
"pattern": "[file:hashes.SHA1 = '31112a415581249f9048d0c3ef6bcc5a1b3ca5f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813aeff-380c-4685-b1c1-4a6702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:11.000Z",
|
|
"modified": "2016-10-28T20:03:11.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4b513dfc68fe825e5f83c51fc1a023c15bf1039e48e025a0a4f4b034dbf443b9",
|
|
"pattern": "[file:hashes.MD5 = '554452f8ce0fbaee93c3bd689a9e6752']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813aeff-d9e0-4ce6-a15e-421802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:11.000Z",
|
|
"modified": "2016-10-28T20:03:11.000Z",
|
|
"first_observed": "2016-10-28T20:03:11Z",
|
|
"last_observed": "2016-10-28T20:03:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813aeff-d9e0-4ce6-a15e-421802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813aeff-d9e0-4ce6-a15e-421802de0b81",
|
|
"value": "https://www.virustotal.com/file/4b513dfc68fe825e5f83c51fc1a023c15bf1039e48e025a0a4f4b034dbf443b9/analysis/1475973644/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af00-7cbc-4e35-b969-474f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:12.000Z",
|
|
"modified": "2016-10-28T20:03:12.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 6b46b6eff4be06d47284492fed7f71c53103bfaa610952151bddebb8046a34f1",
|
|
"pattern": "[file:hashes.SHA1 = '8547d7e395586c8ee8769ccae40a1ca360a0d700']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af00-89c4-44b2-8f69-491902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:12.000Z",
|
|
"modified": "2016-10-28T20:03:12.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 6b46b6eff4be06d47284492fed7f71c53103bfaa610952151bddebb8046a34f1",
|
|
"pattern": "[file:hashes.MD5 = 'c3d72c00dcaafb29dca45e7579185d4b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af01-3534-4450-8b3d-472702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:13.000Z",
|
|
"modified": "2016-10-28T20:03:13.000Z",
|
|
"first_observed": "2016-10-28T20:03:13Z",
|
|
"last_observed": "2016-10-28T20:03:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af01-3534-4450-8b3d-472702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af01-3534-4450-8b3d-472702de0b81",
|
|
"value": "https://www.virustotal.com/file/6b46b6eff4be06d47284492fed7f71c53103bfaa610952151bddebb8046a34f1/analysis/1477244686/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af01-aa50-4ba0-b8aa-42d102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:13.000Z",
|
|
"modified": "2016-10-28T20:03:13.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 18bbffd0e4beb9bc9b7b5c53abeaee44cc16abbffa5a3481035acd0ad26cf248",
|
|
"pattern": "[file:hashes.SHA1 = 'ddee58a44483f9bbb836b9a55773f8e8e0a1fa1f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af02-07bc-43a5-ac04-4d4402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:14.000Z",
|
|
"modified": "2016-10-28T20:03:14.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 18bbffd0e4beb9bc9b7b5c53abeaee44cc16abbffa5a3481035acd0ad26cf248",
|
|
"pattern": "[file:hashes.MD5 = '33bbf232c12ea80b4bc0a200bb210716']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af02-67f4-45d8-87c8-43e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:14.000Z",
|
|
"modified": "2016-10-28T20:03:14.000Z",
|
|
"first_observed": "2016-10-28T20:03:14Z",
|
|
"last_observed": "2016-10-28T20:03:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af02-67f4-45d8-87c8-43e302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af02-67f4-45d8-87c8-43e302de0b81",
|
|
"value": "https://www.virustotal.com/file/18bbffd0e4beb9bc9b7b5c53abeaee44cc16abbffa5a3481035acd0ad26cf248/analysis/1476618909/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af03-986c-455d-8400-4dfd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:15.000Z",
|
|
"modified": "2016-10-28T20:03:15.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7ee718e31ce160126cfdc88fedd1a936b91550c3d2906927818eb7fd8ab2d149",
|
|
"pattern": "[file:hashes.SHA1 = '1e10e5fc402d6064e133cb442447c67ad3dda6e3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af03-3aa0-417d-b74e-437e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:15.000Z",
|
|
"modified": "2016-10-28T20:03:15.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7ee718e31ce160126cfdc88fedd1a936b91550c3d2906927818eb7fd8ab2d149",
|
|
"pattern": "[file:hashes.MD5 = '146abde6d6c38e95d4a0ff8409be1c2e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af04-92a8-41f5-9626-426d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:16.000Z",
|
|
"modified": "2016-10-28T20:03:16.000Z",
|
|
"first_observed": "2016-10-28T20:03:16Z",
|
|
"last_observed": "2016-10-28T20:03:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af04-92a8-41f5-9626-426d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af04-92a8-41f5-9626-426d02de0b81",
|
|
"value": "https://www.virustotal.com/file/7ee718e31ce160126cfdc88fedd1a936b91550c3d2906927818eb7fd8ab2d149/analysis/1474113696/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af04-83e4-413f-afac-453e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:16.000Z",
|
|
"modified": "2016-10-28T20:03:16.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0e6c53797964b611c867cb5e5b492d45edf5472924c9a60a99433240f1712f15",
|
|
"pattern": "[file:hashes.SHA1 = '1ec8937dbeb586a7dac9e76c65d4ee65bcdd0e7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af05-4ef4-47ba-be0d-4e5502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:17.000Z",
|
|
"modified": "2016-10-28T20:03:17.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0e6c53797964b611c867cb5e5b492d45edf5472924c9a60a99433240f1712f15",
|
|
"pattern": "[file:hashes.MD5 = 'b2e498b4f978dcaa3ab719571029633c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af05-41ec-4aad-aaac-400602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:17.000Z",
|
|
"modified": "2016-10-28T20:03:17.000Z",
|
|
"first_observed": "2016-10-28T20:03:17Z",
|
|
"last_observed": "2016-10-28T20:03:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af05-41ec-4aad-aaac-400602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af05-41ec-4aad-aaac-400602de0b81",
|
|
"value": "https://www.virustotal.com/file/0e6c53797964b611c867cb5e5b492d45edf5472924c9a60a99433240f1712f15/analysis/1472712551/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af06-e72c-4a90-8d5d-47a402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:18.000Z",
|
|
"modified": "2016-10-28T20:03:18.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ff09e360d68a8c84646cba8898812c8d967e48ad33f0950da2492104312c7aea",
|
|
"pattern": "[file:hashes.SHA1 = '80526abebe5573b299fe5499c15f590ea7d0e85a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af06-1d2c-4422-9249-449f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:18.000Z",
|
|
"modified": "2016-10-28T20:03:18.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ff09e360d68a8c84646cba8898812c8d967e48ad33f0950da2492104312c7aea",
|
|
"pattern": "[file:hashes.MD5 = 'ef62b2fd75678d9a1c45476d70ff9554']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af07-0f60-445e-a478-4d6a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:19.000Z",
|
|
"modified": "2016-10-28T20:03:19.000Z",
|
|
"first_observed": "2016-10-28T20:03:19Z",
|
|
"last_observed": "2016-10-28T20:03:19Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af07-0f60-445e-a478-4d6a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af07-0f60-445e-a478-4d6a02de0b81",
|
|
"value": "https://www.virustotal.com/file/ff09e360d68a8c84646cba8898812c8d967e48ad33f0950da2492104312c7aea/analysis/1476619453/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af07-4e60-422f-86d3-405502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:19.000Z",
|
|
"modified": "2016-10-28T20:03:19.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2d468ca14aa7c9367f2233197ffcd0cf3703ac6a087f5b9c06ea72eb29bc00eb",
|
|
"pattern": "[file:hashes.SHA1 = 'e9f93376a918c67d3310c9d86e723ce36bf44a8e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af08-5944-4b9b-a903-40a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:20.000Z",
|
|
"modified": "2016-10-28T20:03:20.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2d468ca14aa7c9367f2233197ffcd0cf3703ac6a087f5b9c06ea72eb29bc00eb",
|
|
"pattern": "[file:hashes.MD5 = 'be4e4f69fff611bb5dc5e7fe62a5a2f3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af08-9114-43f7-9525-488d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:20.000Z",
|
|
"modified": "2016-10-28T20:03:20.000Z",
|
|
"first_observed": "2016-10-28T20:03:20Z",
|
|
"last_observed": "2016-10-28T20:03:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af08-9114-43f7-9525-488d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af08-9114-43f7-9525-488d02de0b81",
|
|
"value": "https://www.virustotal.com/file/2d468ca14aa7c9367f2233197ffcd0cf3703ac6a087f5b9c06ea72eb29bc00eb/analysis/1472723379/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af09-2f10-4424-98c7-4b5102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:21.000Z",
|
|
"modified": "2016-10-28T20:03:21.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a78230219df28b5274580a2fb7693bca98a2217ad5d1c25a5db2f853871a2e89",
|
|
"pattern": "[file:hashes.SHA1 = '3b4f5cf4e99f653043a49ca76599e46954abe67c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af09-db34-413f-a5bd-481702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:21.000Z",
|
|
"modified": "2016-10-28T20:03:21.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a78230219df28b5274580a2fb7693bca98a2217ad5d1c25a5db2f853871a2e89",
|
|
"pattern": "[file:hashes.MD5 = 'fa4dfdf5472872eba3883e1d42b78390']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af0a-092c-4b97-8261-454602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:22.000Z",
|
|
"modified": "2016-10-28T20:03:22.000Z",
|
|
"first_observed": "2016-10-28T20:03:22Z",
|
|
"last_observed": "2016-10-28T20:03:22Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af0a-092c-4b97-8261-454602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af0a-092c-4b97-8261-454602de0b81",
|
|
"value": "https://www.virustotal.com/file/a78230219df28b5274580a2fb7693bca98a2217ad5d1c25a5db2f853871a2e89/analysis/1476617526/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0a-9fcc-4d73-9328-486a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:22.000Z",
|
|
"modified": "2016-10-28T20:03:22.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4524d20635f86743572459761fec72cac6efa5bb4a35e19426c342609505a013",
|
|
"pattern": "[file:hashes.SHA1 = '9c0301b6d7f07bc99b8d4ed26eeeb5f61081d409']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0b-f0a8-49d7-a5d5-473602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:23.000Z",
|
|
"modified": "2016-10-28T20:03:23.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4524d20635f86743572459761fec72cac6efa5bb4a35e19426c342609505a013",
|
|
"pattern": "[file:hashes.MD5 = 'ba3fcaa3ba7a0a561705954589469169']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af0b-de80-44e7-8951-496502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:23.000Z",
|
|
"modified": "2016-10-28T20:03:23.000Z",
|
|
"first_observed": "2016-10-28T20:03:23Z",
|
|
"last_observed": "2016-10-28T20:03:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af0b-de80-44e7-8951-496502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af0b-de80-44e7-8951-496502de0b81",
|
|
"value": "https://www.virustotal.com/file/4524d20635f86743572459761fec72cac6efa5bb4a35e19426c342609505a013/analysis/1472712287/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0c-cf8c-4579-a4de-4b5b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:24.000Z",
|
|
"modified": "2016-10-28T20:03:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3606303974653b5dc9ece6700997c462192f169aa0e63f3a9c031b87370643ce",
|
|
"pattern": "[file:hashes.SHA1 = '40efa2feb3ca5f5b54987a1381f0a2fc0475c552']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0c-339c-4615-8b3c-48c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:24.000Z",
|
|
"modified": "2016-10-28T20:03:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3606303974653b5dc9ece6700997c462192f169aa0e63f3a9c031b87370643ce",
|
|
"pattern": "[file:hashes.MD5 = '43f71d726a2b532de2e1df88f115b37d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af0d-81c0-470b-87df-46fe02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:25.000Z",
|
|
"modified": "2016-10-28T20:03:25.000Z",
|
|
"first_observed": "2016-10-28T20:03:25Z",
|
|
"last_observed": "2016-10-28T20:03:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af0d-81c0-470b-87df-46fe02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af0d-81c0-470b-87df-46fe02de0b81",
|
|
"value": "https://www.virustotal.com/file/3606303974653b5dc9ece6700997c462192f169aa0e63f3a9c031b87370643ce/analysis/1472711466/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0d-67c8-49a0-bd07-42f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:25.000Z",
|
|
"modified": "2016-10-28T20:03:25.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: fcd621c978e203ca3bc698f84353a0674888122a8d26bc288d28f53f1968b6d8",
|
|
"pattern": "[file:hashes.SHA1 = '944cf2469fc421a016533fb404371e0c4a7775a5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0e-765c-47ec-99a4-47aa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:26.000Z",
|
|
"modified": "2016-10-28T20:03:26.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: fcd621c978e203ca3bc698f84353a0674888122a8d26bc288d28f53f1968b6d8",
|
|
"pattern": "[file:hashes.MD5 = '69abd01c9deaeb2058533263a99fce86']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af0e-6904-447b-be51-4cec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:26.000Z",
|
|
"modified": "2016-10-28T20:03:26.000Z",
|
|
"first_observed": "2016-10-28T20:03:26Z",
|
|
"last_observed": "2016-10-28T20:03:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af0e-6904-447b-be51-4cec02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af0e-6904-447b-be51-4cec02de0b81",
|
|
"value": "https://www.virustotal.com/file/fcd621c978e203ca3bc698f84353a0674888122a8d26bc288d28f53f1968b6d8/analysis/1476617067/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0f-fc6c-49ca-96e6-4ee802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:27.000Z",
|
|
"modified": "2016-10-28T20:03:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 46337159fc31aac4ca678d86101ab2a0f08345a6604c18c1d8071f32056cd0ad",
|
|
"pattern": "[file:hashes.SHA1 = 'd0f6a900eeeecca1c4e0a6d795d339bdb9868d6b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af0f-fb30-4ec7-81ad-494202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:27.000Z",
|
|
"modified": "2016-10-28T20:03:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 46337159fc31aac4ca678d86101ab2a0f08345a6604c18c1d8071f32056cd0ad",
|
|
"pattern": "[file:hashes.MD5 = '573c18b25302ed782332bbd59d737a2e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af10-b7f0-42a3-b5f2-4b4d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:28.000Z",
|
|
"modified": "2016-10-28T20:03:28.000Z",
|
|
"first_observed": "2016-10-28T20:03:28Z",
|
|
"last_observed": "2016-10-28T20:03:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af10-b7f0-42a3-b5f2-4b4d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af10-b7f0-42a3-b5f2-4b4d02de0b81",
|
|
"value": "https://www.virustotal.com/file/46337159fc31aac4ca678d86101ab2a0f08345a6604c18c1d8071f32056cd0ad/analysis/1476619812/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af10-9e44-4531-a0c9-48f202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:28.000Z",
|
|
"modified": "2016-10-28T20:03:28.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1e8341e46820af65a9fdbdcfa55b7c1556449cc99755545063082394d764eab5",
|
|
"pattern": "[file:hashes.SHA1 = 'ee915a67e978db223bac82e4347ba4814eeff6f0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af11-2f98-4f72-bbc8-492302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:29.000Z",
|
|
"modified": "2016-10-28T20:03:29.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1e8341e46820af65a9fdbdcfa55b7c1556449cc99755545063082394d764eab5",
|
|
"pattern": "[file:hashes.MD5 = 'd508f398e7385d76c9be1dfd230560d0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af11-338c-4df6-85c5-49ef02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:29.000Z",
|
|
"modified": "2016-10-28T20:03:29.000Z",
|
|
"first_observed": "2016-10-28T20:03:29Z",
|
|
"last_observed": "2016-10-28T20:03:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af11-338c-4df6-85c5-49ef02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af11-338c-4df6-85c5-49ef02de0b81",
|
|
"value": "https://www.virustotal.com/file/1e8341e46820af65a9fdbdcfa55b7c1556449cc99755545063082394d764eab5/analysis/1476618184/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af12-2910-4b31-9e2f-4bcf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:30.000Z",
|
|
"modified": "2016-10-28T20:03:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b30dfa13f8dc7162f3edb43dff8507f82c01bd5bd6e5a1ae2e3b2e55dd6b10c0",
|
|
"pattern": "[file:hashes.SHA1 = '327e68fcc2805735d47bbff7ece5611e028623cf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af12-dbcc-4f38-bda4-435302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:30.000Z",
|
|
"modified": "2016-10-28T20:03:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b30dfa13f8dc7162f3edb43dff8507f82c01bd5bd6e5a1ae2e3b2e55dd6b10c0",
|
|
"pattern": "[file:hashes.MD5 = 'bed1f21abcacf1ba8ce6093dec0a2333']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af13-28e8-4c50-add7-439902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:31.000Z",
|
|
"modified": "2016-10-28T20:03:31.000Z",
|
|
"first_observed": "2016-10-28T20:03:31Z",
|
|
"last_observed": "2016-10-28T20:03:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af13-28e8-4c50-add7-439902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af13-28e8-4c50-add7-439902de0b81",
|
|
"value": "https://www.virustotal.com/file/b30dfa13f8dc7162f3edb43dff8507f82c01bd5bd6e5a1ae2e3b2e55dd6b10c0/analysis/1472712443/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af13-69ac-427b-877e-4ee302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:31.000Z",
|
|
"modified": "2016-10-28T20:03:31.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9d41dc182dee0690e5c5f08f9276548a85f4b986478fd30ec4208d95d54cffeb",
|
|
"pattern": "[file:hashes.SHA1 = '7557ff1db247dcf9e6876fc50209cbafc36f8192']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af14-3464-4915-bf7d-4c2c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:32.000Z",
|
|
"modified": "2016-10-28T20:03:32.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9d41dc182dee0690e5c5f08f9276548a85f4b986478fd30ec4208d95d54cffeb",
|
|
"pattern": "[file:hashes.MD5 = '4aa43cead9cf8c7ba9216e5df67981ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af14-4740-438c-958b-4b8f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:32.000Z",
|
|
"modified": "2016-10-28T20:03:32.000Z",
|
|
"first_observed": "2016-10-28T20:03:32Z",
|
|
"last_observed": "2016-10-28T20:03:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af14-4740-438c-958b-4b8f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af14-4740-438c-958b-4b8f02de0b81",
|
|
"value": "https://www.virustotal.com/file/9d41dc182dee0690e5c5f08f9276548a85f4b986478fd30ec4208d95d54cffeb/analysis/1472712596/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af15-d748-441e-a7a9-476b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:33.000Z",
|
|
"modified": "2016-10-28T20:03:33.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2b7555bfa3794903bd59955db795213bcb5c9d678029184967ad8f71cc653980",
|
|
"pattern": "[file:hashes.SHA1 = '86b8ec6c8fe9a456b540447752f57edab64f96f2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af15-52b8-45dc-9849-43a502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:33.000Z",
|
|
"modified": "2016-10-28T20:03:33.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2b7555bfa3794903bd59955db795213bcb5c9d678029184967ad8f71cc653980",
|
|
"pattern": "[file:hashes.MD5 = '25c4e5643f832a064c532e39dafbb3fd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af16-9ee0-4ff4-bd24-42ce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:34.000Z",
|
|
"modified": "2016-10-28T20:03:34.000Z",
|
|
"first_observed": "2016-10-28T20:03:34Z",
|
|
"last_observed": "2016-10-28T20:03:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af16-9ee0-4ff4-bd24-42ce02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af16-9ee0-4ff4-bd24-42ce02de0b81",
|
|
"value": "https://www.virustotal.com/file/2b7555bfa3794903bd59955db795213bcb5c9d678029184967ad8f71cc653980/analysis/1476617170/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af16-657c-4f19-96b6-4a6a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:34.000Z",
|
|
"modified": "2016-10-28T20:03:34.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 64c62a718a1998ead5b49b0b859253673d69135d3a2508ccd923f16fd6232fc5",
|
|
"pattern": "[file:hashes.SHA1 = 'a4bb893319b99b1333b7013a969613d1f1c90347']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af17-d00c-4811-acdd-4af002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:35.000Z",
|
|
"modified": "2016-10-28T20:03:35.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 64c62a718a1998ead5b49b0b859253673d69135d3a2508ccd923f16fd6232fc5",
|
|
"pattern": "[file:hashes.MD5 = 'c104ceade8b1a4538175ca92b345e25b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af17-530c-4264-9f4f-451702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:35.000Z",
|
|
"modified": "2016-10-28T20:03:35.000Z",
|
|
"first_observed": "2016-10-28T20:03:35Z",
|
|
"last_observed": "2016-10-28T20:03:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af17-530c-4264-9f4f-451702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af17-530c-4264-9f4f-451702de0b81",
|
|
"value": "https://www.virustotal.com/file/64c62a718a1998ead5b49b0b859253673d69135d3a2508ccd923f16fd6232fc5/analysis/1476618702/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af18-11b8-481c-977b-4b7602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:36.000Z",
|
|
"modified": "2016-10-28T20:03:36.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 251a2e72eee5581aafbb9d109cf0133a07b8426950de381020849347dd619f18",
|
|
"pattern": "[file:hashes.SHA1 = 'c807927bbd30712f0fe5577e252958653a8bb7f1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af18-81d0-4ef9-9c38-445b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:36.000Z",
|
|
"modified": "2016-10-28T20:03:36.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 251a2e72eee5581aafbb9d109cf0133a07b8426950de381020849347dd619f18",
|
|
"pattern": "[file:hashes.MD5 = '9a907af39f623bc088e5226e178a1f3a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af19-1688-440b-a348-4ae402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:37.000Z",
|
|
"modified": "2016-10-28T20:03:37.000Z",
|
|
"first_observed": "2016-10-28T20:03:37Z",
|
|
"last_observed": "2016-10-28T20:03:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af19-1688-440b-a348-4ae402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af19-1688-440b-a348-4ae402de0b81",
|
|
"value": "https://www.virustotal.com/file/251a2e72eee5581aafbb9d109cf0133a07b8426950de381020849347dd619f18/analysis/1476618694/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af19-968c-4720-a287-40ed02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:37.000Z",
|
|
"modified": "2016-10-28T20:03:37.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 22c30799fc61601d22ab5ee5076512814eb0bcc8ea215c13e079c59c155b9412",
|
|
"pattern": "[file:hashes.SHA1 = 'd8514e78a4eadc11b01b774d9bf2e996b8cb7e9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1a-bc0c-45fd-84d0-4a7b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:38.000Z",
|
|
"modified": "2016-10-28T20:03:38.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 22c30799fc61601d22ab5ee5076512814eb0bcc8ea215c13e079c59c155b9412",
|
|
"pattern": "[file:hashes.MD5 = '9db3e2e0c1a81abc82701c49bb8f4fea']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af1a-1418-40ab-a301-4fb602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:38.000Z",
|
|
"modified": "2016-10-28T20:03:38.000Z",
|
|
"first_observed": "2016-10-28T20:03:38Z",
|
|
"last_observed": "2016-10-28T20:03:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af1a-1418-40ab-a301-4fb602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af1a-1418-40ab-a301-4fb602de0b81",
|
|
"value": "https://www.virustotal.com/file/22c30799fc61601d22ab5ee5076512814eb0bcc8ea215c13e079c59c155b9412/analysis/1472712166/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1b-533c-4b3e-9ab4-4a5002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:39.000Z",
|
|
"modified": "2016-10-28T20:03:39.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d282f723998a4b0768a8d3e1c73997cf9ab9fcee43e4a7f0c8c76e9cff67d347",
|
|
"pattern": "[file:hashes.SHA1 = 'fc1ee3cc68b7893e5aea20b3e89961a507550af7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1b-67cc-451a-bbe3-4f5d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:39.000Z",
|
|
"modified": "2016-10-28T20:03:39.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d282f723998a4b0768a8d3e1c73997cf9ab9fcee43e4a7f0c8c76e9cff67d347",
|
|
"pattern": "[file:hashes.MD5 = '449ba00f392fb04af802a690bffcbb59']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af1c-2008-4acc-96a7-406c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:40.000Z",
|
|
"modified": "2016-10-28T20:03:40.000Z",
|
|
"first_observed": "2016-10-28T20:03:40Z",
|
|
"last_observed": "2016-10-28T20:03:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af1c-2008-4acc-96a7-406c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af1c-2008-4acc-96a7-406c02de0b81",
|
|
"value": "https://www.virustotal.com/file/d282f723998a4b0768a8d3e1c73997cf9ab9fcee43e4a7f0c8c76e9cff67d347/analysis/1476619799/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1c-f0a0-4d8c-b1ee-438502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:40.000Z",
|
|
"modified": "2016-10-28T20:03:40.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8f5996d84577318b2081061d4dc583a2d7bea3a9d77052ac6be51ef180587608",
|
|
"pattern": "[file:hashes.SHA1 = '55d2822e88ca2c55734bc9467cc715fb0104e38b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1d-3850-44a2-9f41-451c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:41.000Z",
|
|
"modified": "2016-10-28T20:03:41.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8f5996d84577318b2081061d4dc583a2d7bea3a9d77052ac6be51ef180587608",
|
|
"pattern": "[file:hashes.MD5 = '1b4fd16fc9d6bfb928ec72e77d826c2f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af1d-4e58-4711-bed3-40b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:41.000Z",
|
|
"modified": "2016-10-28T20:03:41.000Z",
|
|
"first_observed": "2016-10-28T20:03:41Z",
|
|
"last_observed": "2016-10-28T20:03:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af1d-4e58-4711-bed3-40b902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af1d-4e58-4711-bed3-40b902de0b81",
|
|
"value": "https://www.virustotal.com/file/8f5996d84577318b2081061d4dc583a2d7bea3a9d77052ac6be51ef180587608/analysis/1472710652/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1e-a248-48d9-8cd7-448802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:42.000Z",
|
|
"modified": "2016-10-28T20:03:42.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8cb70ac6d9b7da09c30514dce788b9626f8c115d3aff9d50ca97667de1e834c4",
|
|
"pattern": "[file:hashes.SHA1 = '47a38e664b0e3ab6841a5e209a28fc140dae87dc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1e-a91c-4507-b0b1-420202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:42.000Z",
|
|
"modified": "2016-10-28T20:03:42.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8cb70ac6d9b7da09c30514dce788b9626f8c115d3aff9d50ca97667de1e834c4",
|
|
"pattern": "[file:hashes.MD5 = '24eca5bbe675b1719613adfa8f4d958a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af1f-1004-43a1-a757-4a6702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:43.000Z",
|
|
"modified": "2016-10-28T20:03:43.000Z",
|
|
"first_observed": "2016-10-28T20:03:43Z",
|
|
"last_observed": "2016-10-28T20:03:43Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af1f-1004-43a1-a757-4a6702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af1f-1004-43a1-a757-4a6702de0b81",
|
|
"value": "https://www.virustotal.com/file/8cb70ac6d9b7da09c30514dce788b9626f8c115d3aff9d50ca97667de1e834c4/analysis/1472712821/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af1f-c094-42cf-a135-45bb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:43.000Z",
|
|
"modified": "2016-10-28T20:03:43.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2c091e180910f751813cb6169025e33161f1c0b9fe1443bf3aab40281820e331",
|
|
"pattern": "[file:hashes.SHA1 = '5271915003bde8199256141ec70eb80ec1abc73b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af20-d1e0-4228-b216-469f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:44.000Z",
|
|
"modified": "2016-10-28T20:03:44.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2c091e180910f751813cb6169025e33161f1c0b9fe1443bf3aab40281820e331",
|
|
"pattern": "[file:hashes.MD5 = '01d54aa687756bbea7089b1f47352018']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af20-1454-4f76-bef4-40d502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:44.000Z",
|
|
"modified": "2016-10-28T20:03:44.000Z",
|
|
"first_observed": "2016-10-28T20:03:44Z",
|
|
"last_observed": "2016-10-28T20:03:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af20-1454-4f76-bef4-40d502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af20-1454-4f76-bef4-40d502de0b81",
|
|
"value": "https://www.virustotal.com/file/2c091e180910f751813cb6169025e33161f1c0b9fe1443bf3aab40281820e331/analysis/1476617337/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af21-c9f8-4632-b6ba-488302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:45.000Z",
|
|
"modified": "2016-10-28T20:03:45.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4d6563811972d1cd663e95bbdcfa06c1320445c0bbe1d370403253325d764357",
|
|
"pattern": "[file:hashes.SHA1 = '51f40b8429f006060accff23b7e1ac14a9359d66']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af21-c180-4b6f-b6bb-4c6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:45.000Z",
|
|
"modified": "2016-10-28T20:03:45.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 4d6563811972d1cd663e95bbdcfa06c1320445c0bbe1d370403253325d764357",
|
|
"pattern": "[file:hashes.MD5 = 'e194f0b1d5ac568c8a5ab05773d10dd1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af22-b720-414c-b497-43ac02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:46.000Z",
|
|
"modified": "2016-10-28T20:03:46.000Z",
|
|
"first_observed": "2016-10-28T20:03:46Z",
|
|
"last_observed": "2016-10-28T20:03:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af22-b720-414c-b497-43ac02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af22-b720-414c-b497-43ac02de0b81",
|
|
"value": "https://www.virustotal.com/file/4d6563811972d1cd663e95bbdcfa06c1320445c0bbe1d370403253325d764357/analysis/1476620010/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af22-55e0-4684-afee-4e6202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:46.000Z",
|
|
"modified": "2016-10-28T20:03:46.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: aea3ccce007af974123c68c64dc19d6e7745f5966d7269da8e9e551551702dea",
|
|
"pattern": "[file:hashes.SHA1 = '5c905feae5f1547361f95a13ea7cc766bb8500fc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af23-6674-49e5-9675-4e3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:47.000Z",
|
|
"modified": "2016-10-28T20:03:47.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: aea3ccce007af974123c68c64dc19d6e7745f5966d7269da8e9e551551702dea",
|
|
"pattern": "[file:hashes.MD5 = 'ca4b3c0452ceffcd9a426dfd582e69ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af23-1084-4844-910c-431202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:47.000Z",
|
|
"modified": "2016-10-28T20:03:47.000Z",
|
|
"first_observed": "2016-10-28T20:03:47Z",
|
|
"last_observed": "2016-10-28T20:03:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af23-1084-4844-910c-431202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af23-1084-4844-910c-431202de0b81",
|
|
"value": "https://www.virustotal.com/file/aea3ccce007af974123c68c64dc19d6e7745f5966d7269da8e9e551551702dea/analysis/1476620809/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af24-6664-4150-b7a0-460102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:48.000Z",
|
|
"modified": "2016-10-28T20:03:48.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3c214302047db629f6ac84e5495af21e8cb73497c587862236477b731d304640",
|
|
"pattern": "[file:hashes.SHA1 = '4110c8e6241d5e6281e4d309f3c531d8311874cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af24-b710-441b-bdd8-4e7302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:48.000Z",
|
|
"modified": "2016-10-28T20:03:48.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3c214302047db629f6ac84e5495af21e8cb73497c587862236477b731d304640",
|
|
"pattern": "[file:hashes.MD5 = '9b9e197487abb748b2e504d747a0f442']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af25-55a8-4d26-b440-4ec802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:49.000Z",
|
|
"modified": "2016-10-28T20:03:49.000Z",
|
|
"first_observed": "2016-10-28T20:03:49Z",
|
|
"last_observed": "2016-10-28T20:03:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af25-55a8-4d26-b440-4ec802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af25-55a8-4d26-b440-4ec802de0b81",
|
|
"value": "https://www.virustotal.com/file/3c214302047db629f6ac84e5495af21e8cb73497c587862236477b731d304640/analysis/1474389955/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af25-5584-4b55-b4e6-45d302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:49.000Z",
|
|
"modified": "2016-10-28T20:03:49.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7b0e6e65d0b3c7c82eb3041505a217feb5db1702e4f284dcfdb4fe28b166c13c",
|
|
"pattern": "[file:hashes.SHA1 = '1a4ebea091eb802cc349c74d9f79678b6fef05e3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af26-0ef4-49bb-b947-4e0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:50.000Z",
|
|
"modified": "2016-10-28T20:03:50.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 7b0e6e65d0b3c7c82eb3041505a217feb5db1702e4f284dcfdb4fe28b166c13c",
|
|
"pattern": "[file:hashes.MD5 = 'c755238416f3960a4cc2d9c9452d0f30']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af26-101c-4eec-9882-450302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:50.000Z",
|
|
"modified": "2016-10-28T20:03:50.000Z",
|
|
"first_observed": "2016-10-28T20:03:50Z",
|
|
"last_observed": "2016-10-28T20:03:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af26-101c-4eec-9882-450302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af26-101c-4eec-9882-450302de0b81",
|
|
"value": "https://www.virustotal.com/file/7b0e6e65d0b3c7c82eb3041505a217feb5db1702e4f284dcfdb4fe28b166c13c/analysis/1472914418/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af27-9330-43fd-b1ac-412702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:51.000Z",
|
|
"modified": "2016-10-28T20:03:51.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2963835a0ba3476cffd75e527bfe50dc490efae252e1cdecd581438e2fd15957",
|
|
"pattern": "[file:hashes.SHA1 = 'a48f6e4de40cc9249010df4afeebecec2711a37b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af27-13d8-473c-8c86-48a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:51.000Z",
|
|
"modified": "2016-10-28T20:03:51.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2963835a0ba3476cffd75e527bfe50dc490efae252e1cdecd581438e2fd15957",
|
|
"pattern": "[file:hashes.MD5 = '15136c22f6fae383f650a9c559eb33e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af28-b5e0-46a3-b93f-4de602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:52.000Z",
|
|
"modified": "2016-10-28T20:03:52.000Z",
|
|
"first_observed": "2016-10-28T20:03:52Z",
|
|
"last_observed": "2016-10-28T20:03:52Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af28-b5e0-46a3-b93f-4de602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af28-b5e0-46a3-b93f-4de602de0b81",
|
|
"value": "https://www.virustotal.com/file/2963835a0ba3476cffd75e527bfe50dc490efae252e1cdecd581438e2fd15957/analysis/1476619099/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af28-6a8c-478e-a64c-476502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:52.000Z",
|
|
"modified": "2016-10-28T20:03:52.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 208bfc3480b620aa39cb6da5eaf04dd9ad0665bdde16423634ae3c90e1242157",
|
|
"pattern": "[file:hashes.SHA1 = 'c31d7420e0dde2633b4f72d2b59000cfa362afa6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af29-f560-4e1d-8bc2-402a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:53.000Z",
|
|
"modified": "2016-10-28T20:03:53.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 208bfc3480b620aa39cb6da5eaf04dd9ad0665bdde16423634ae3c90e1242157",
|
|
"pattern": "[file:hashes.MD5 = '5965e7bdc1a0412ce7ecde87dce262df']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af29-3f98-41ed-8d7a-407902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:53.000Z",
|
|
"modified": "2016-10-28T20:03:53.000Z",
|
|
"first_observed": "2016-10-28T20:03:53Z",
|
|
"last_observed": "2016-10-28T20:03:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af29-3f98-41ed-8d7a-407902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af29-3f98-41ed-8d7a-407902de0b81",
|
|
"value": "https://www.virustotal.com/file/208bfc3480b620aa39cb6da5eaf04dd9ad0665bdde16423634ae3c90e1242157/analysis/1474480383/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2a-b7e8-48ae-b46c-42e802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:54.000Z",
|
|
"modified": "2016-10-28T20:03:54.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a1000d4cb81cfb7dfac660722938f3d9c7cb6e36c33e129097ddd29f3dfd1890",
|
|
"pattern": "[file:hashes.SHA1 = '453b47a97027c7c40f27173fb3dd52a2f95be571']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2a-65ac-4df9-b8dd-4bb602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:54.000Z",
|
|
"modified": "2016-10-28T20:03:54.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a1000d4cb81cfb7dfac660722938f3d9c7cb6e36c33e129097ddd29f3dfd1890",
|
|
"pattern": "[file:hashes.MD5 = '15c514a37849dfe22a2431c1e2ea1a52']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af2b-63a0-442a-8851-494702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:55.000Z",
|
|
"modified": "2016-10-28T20:03:55.000Z",
|
|
"first_observed": "2016-10-28T20:03:55Z",
|
|
"last_observed": "2016-10-28T20:03:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af2b-63a0-442a-8851-494702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af2b-63a0-442a-8851-494702de0b81",
|
|
"value": "https://www.virustotal.com/file/a1000d4cb81cfb7dfac660722938f3d9c7cb6e36c33e129097ddd29f3dfd1890/analysis/1472712603/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2b-bfe4-4c80-94c7-46c902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:55.000Z",
|
|
"modified": "2016-10-28T20:03:55.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 5088f65fe343d3f698765289098bd9d35c4968f113d2ad4920eeb511b075383a",
|
|
"pattern": "[file:hashes.SHA1 = 'bff794625d2dbdcb5a282ca074b078a0a00fcfc0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2c-6830-4718-b4b3-471502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:56.000Z",
|
|
"modified": "2016-10-28T20:03:56.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 5088f65fe343d3f698765289098bd9d35c4968f113d2ad4920eeb511b075383a",
|
|
"pattern": "[file:hashes.MD5 = 'e904b1a37d4efae5281ecc6945121b94']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af2c-fff0-4d9d-8691-442202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:56.000Z",
|
|
"modified": "2016-10-28T20:03:56.000Z",
|
|
"first_observed": "2016-10-28T20:03:56Z",
|
|
"last_observed": "2016-10-28T20:03:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af2c-fff0-4d9d-8691-442202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af2c-fff0-4d9d-8691-442202de0b81",
|
|
"value": "https://www.virustotal.com/file/5088f65fe343d3f698765289098bd9d35c4968f113d2ad4920eeb511b075383a/analysis/1476617838/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2d-8ae8-4c3c-a986-43de02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:57.000Z",
|
|
"modified": "2016-10-28T20:03:57.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 53a5d799f91a6b5ae4878dcdc933cb497eac57b750744998feb8f07d9f683d22",
|
|
"pattern": "[file:hashes.SHA1 = '36427a2811cd31351f1191384920014c9237b530']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2d-3910-4ea8-82f8-450502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:57.000Z",
|
|
"modified": "2016-10-28T20:03:57.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 53a5d799f91a6b5ae4878dcdc933cb497eac57b750744998feb8f07d9f683d22",
|
|
"pattern": "[file:hashes.MD5 = '3f6e6293bbb3473378055931d65c6cdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af2e-6c50-4cf9-b027-49b902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:58.000Z",
|
|
"modified": "2016-10-28T20:03:58.000Z",
|
|
"first_observed": "2016-10-28T20:03:58Z",
|
|
"last_observed": "2016-10-28T20:03:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af2e-6c50-4cf9-b027-49b902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af2e-6c50-4cf9-b027-49b902de0b81",
|
|
"value": "https://www.virustotal.com/file/53a5d799f91a6b5ae4878dcdc933cb497eac57b750744998feb8f07d9f683d22/analysis/1476618313/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2e-2ca4-4fca-8e71-46c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:58.000Z",
|
|
"modified": "2016-10-28T20:03:58.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 04f865ddb593a39b4153b030ae723c9099a46a481e93fdbcc3bf8daea731e4b3",
|
|
"pattern": "[file:hashes.SHA1 = '74292111cce8eec1185fd74498d9ffe2c1d6d421']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af2f-0ffc-4a7f-9eb7-48cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:59.000Z",
|
|
"modified": "2016-10-28T20:03:59.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 04f865ddb593a39b4153b030ae723c9099a46a481e93fdbcc3bf8daea731e4b3",
|
|
"pattern": "[file:hashes.MD5 = 'aacfaf1dfd2f46773122e6e4b23129c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:03:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af2f-4054-4c40-86df-419102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:03:59.000Z",
|
|
"modified": "2016-10-28T20:03:59.000Z",
|
|
"first_observed": "2016-10-28T20:03:59Z",
|
|
"last_observed": "2016-10-28T20:03:59Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af2f-4054-4c40-86df-419102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af2f-4054-4c40-86df-419102de0b81",
|
|
"value": "https://www.virustotal.com/file/04f865ddb593a39b4153b030ae723c9099a46a481e93fdbcc3bf8daea731e4b3/analysis/1474185527/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af30-6584-43b1-9b64-415f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:00.000Z",
|
|
"modified": "2016-10-28T20:04:00.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 30aaf21b1cba8cffcdb0e710316d5a0b7f67b10138997dc5f36a447d48c03a3c",
|
|
"pattern": "[file:hashes.SHA1 = '25ab166811cdd78c838abc37943f92fd6af1d0f4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af30-0404-479a-986a-453702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:00.000Z",
|
|
"modified": "2016-10-28T20:04:00.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 30aaf21b1cba8cffcdb0e710316d5a0b7f67b10138997dc5f36a447d48c03a3c",
|
|
"pattern": "[file:hashes.MD5 = 'db2a0c3d2182f15d9c1c39d0801b2ed6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af31-4e44-4977-98b5-47cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:01.000Z",
|
|
"modified": "2016-10-28T20:04:01.000Z",
|
|
"first_observed": "2016-10-28T20:04:01Z",
|
|
"last_observed": "2016-10-28T20:04:01Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af31-4e44-4977-98b5-47cc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af31-4e44-4977-98b5-47cc02de0b81",
|
|
"value": "https://www.virustotal.com/file/30aaf21b1cba8cffcdb0e710316d5a0b7f67b10138997dc5f36a447d48c03a3c/analysis/1476703452/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af31-b51c-40dd-8287-473802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:01.000Z",
|
|
"modified": "2016-10-28T20:04:01.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c53923874225931ca94799099b86ac5f68b491d3aa7f2773f224adcf6294caf7",
|
|
"pattern": "[file:hashes.SHA1 = 'a1c5d20aea54bfcce13b8697fbb1979cea4cadd0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af32-817c-4879-8a41-4a4102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:02.000Z",
|
|
"modified": "2016-10-28T20:04:02.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c53923874225931ca94799099b86ac5f68b491d3aa7f2773f224adcf6294caf7",
|
|
"pattern": "[file:hashes.MD5 = '9631e72bbc474be5fa70657bde303a9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af32-e964-4819-a123-492e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:02.000Z",
|
|
"modified": "2016-10-28T20:04:02.000Z",
|
|
"first_observed": "2016-10-28T20:04:02Z",
|
|
"last_observed": "2016-10-28T20:04:02Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af32-e964-4819-a123-492e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af32-e964-4819-a123-492e02de0b81",
|
|
"value": "https://www.virustotal.com/file/c53923874225931ca94799099b86ac5f68b491d3aa7f2773f224adcf6294caf7/analysis/1476619042/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af33-868c-4472-933a-439e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:03.000Z",
|
|
"modified": "2016-10-28T20:04:03.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8e7eaed42f50c865f72f7351b87a988de5aa94781b4dab4ddbe993872435f293",
|
|
"pattern": "[file:hashes.SHA1 = 'ab7f933f963ab911523521d1522b2063d0e22d04']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af33-6260-40d6-a7e4-4ad502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:03.000Z",
|
|
"modified": "2016-10-28T20:04:03.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 8e7eaed42f50c865f72f7351b87a988de5aa94781b4dab4ddbe993872435f293",
|
|
"pattern": "[file:hashes.MD5 = '6e278be3182bc14440184b0ceb7838e8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af34-6d84-4b2c-9dc4-45a902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:04.000Z",
|
|
"modified": "2016-10-28T20:04:04.000Z",
|
|
"first_observed": "2016-10-28T20:04:04Z",
|
|
"last_observed": "2016-10-28T20:04:04Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af34-6d84-4b2c-9dc4-45a902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af34-6d84-4b2c-9dc4-45a902de0b81",
|
|
"value": "https://www.virustotal.com/file/8e7eaed42f50c865f72f7351b87a988de5aa94781b4dab4ddbe993872435f293/analysis/1472713183/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af34-64ac-4fa3-ae9f-482702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:04.000Z",
|
|
"modified": "2016-10-28T20:04:04.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2549560970bb8ebca0136f7d6c8111196295d083c6fd6101a7f9178089502cc0",
|
|
"pattern": "[file:hashes.SHA1 = 'dd5401d25b6de778a7f80bef7fe7d6921d7a5350']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af35-8a34-4eb6-b1c2-4e2602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:05.000Z",
|
|
"modified": "2016-10-28T20:04:05.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2549560970bb8ebca0136f7d6c8111196295d083c6fd6101a7f9178089502cc0",
|
|
"pattern": "[file:hashes.MD5 = 'dc84f7efdd76b058756b1451e72683e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af35-1680-47de-96a9-400f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:05.000Z",
|
|
"modified": "2016-10-28T20:04:05.000Z",
|
|
"first_observed": "2016-10-28T20:04:05Z",
|
|
"last_observed": "2016-10-28T20:04:05Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af35-1680-47de-96a9-400f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af35-1680-47de-96a9-400f02de0b81",
|
|
"value": "https://www.virustotal.com/file/2549560970bb8ebca0136f7d6c8111196295d083c6fd6101a7f9178089502cc0/analysis/1472712516/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af36-de78-4057-ad16-478002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:06.000Z",
|
|
"modified": "2016-10-28T20:04:06.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 25ec78c719882cbfe19fbed160d8e50f25d725c6c7b7458ab42f5dda91dee203",
|
|
"pattern": "[file:hashes.SHA1 = '596de4f79685e7d8e99925aa43836d96f4bab031']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af36-68dc-44b6-acca-4d6902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:06.000Z",
|
|
"modified": "2016-10-28T20:04:06.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 25ec78c719882cbfe19fbed160d8e50f25d725c6c7b7458ab42f5dda91dee203",
|
|
"pattern": "[file:hashes.MD5 = 'b84e7820a55af181aef55bac45a3411f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af37-41f4-4365-a5c3-4bfc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:07.000Z",
|
|
"modified": "2016-10-28T20:04:07.000Z",
|
|
"first_observed": "2016-10-28T20:04:07Z",
|
|
"last_observed": "2016-10-28T20:04:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af37-41f4-4365-a5c3-4bfc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af37-41f4-4365-a5c3-4bfc02de0b81",
|
|
"value": "https://www.virustotal.com/file/25ec78c719882cbfe19fbed160d8e50f25d725c6c7b7458ab42f5dda91dee203/analysis/1473167724/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af37-5e90-4ecc-be3e-47ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:07.000Z",
|
|
"modified": "2016-10-28T20:04:07.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 47e9acdba48dfb1948a409b89341b45834e8c3a27cf9e01dfacc7b37c797a3ab",
|
|
"pattern": "[file:hashes.SHA1 = '8c908a01c9a73c98a372e415532835490ab7532d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af38-42ac-4f49-bd50-4c7702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:08.000Z",
|
|
"modified": "2016-10-28T20:04:08.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 47e9acdba48dfb1948a409b89341b45834e8c3a27cf9e01dfacc7b37c797a3ab",
|
|
"pattern": "[file:hashes.MD5 = 'abc2c59f16bcd6307bf73489093a3907']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af38-0200-40ee-9d94-4aa902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:08.000Z",
|
|
"modified": "2016-10-28T20:04:08.000Z",
|
|
"first_observed": "2016-10-28T20:04:08Z",
|
|
"last_observed": "2016-10-28T20:04:08Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af38-0200-40ee-9d94-4aa902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af38-0200-40ee-9d94-4aa902de0b81",
|
|
"value": "https://www.virustotal.com/file/47e9acdba48dfb1948a409b89341b45834e8c3a27cf9e01dfacc7b37c797a3ab/analysis/1476619150/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af39-4004-41de-a47b-40ff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:09.000Z",
|
|
"modified": "2016-10-28T20:04:09.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 950cd068d9c51b941bdfe4721a3156af15dc408d2df23c1f2bc41b87159b109e",
|
|
"pattern": "[file:hashes.SHA1 = '209a33d6776928533dbd7f96fecafb3aaa637bab']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af39-54ec-4803-8284-43cc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:09.000Z",
|
|
"modified": "2016-10-28T20:04:09.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 950cd068d9c51b941bdfe4721a3156af15dc408d2df23c1f2bc41b87159b109e",
|
|
"pattern": "[file:hashes.MD5 = 'ff00f41067f1a421b6502253507686cb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af3a-6910-497f-babe-49d202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:10.000Z",
|
|
"modified": "2016-10-28T20:04:10.000Z",
|
|
"first_observed": "2016-10-28T20:04:10Z",
|
|
"last_observed": "2016-10-28T20:04:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af3a-6910-497f-babe-49d202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af3a-6910-497f-babe-49d202de0b81",
|
|
"value": "https://www.virustotal.com/file/950cd068d9c51b941bdfe4721a3156af15dc408d2df23c1f2bc41b87159b109e/analysis/1472712577/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3a-171c-4526-9340-4e9102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:10.000Z",
|
|
"modified": "2016-10-28T20:04:10.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 81f1925eb2b49a0f18a6036a0cfd0385f1405d6fa0ee7a80f4162a9c6eefc5a9",
|
|
"pattern": "[file:hashes.SHA1 = 'c1663a412aa185e607fb692ca6ce1d7a3ca3e547']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3b-6e60-4f1f-ae4e-4c8d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:11.000Z",
|
|
"modified": "2016-10-28T20:04:11.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 81f1925eb2b49a0f18a6036a0cfd0385f1405d6fa0ee7a80f4162a9c6eefc5a9",
|
|
"pattern": "[file:hashes.MD5 = '9921fd3c2d96b2780dc44f0338383901']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af3b-f1cc-438e-8bd5-437702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:11.000Z",
|
|
"modified": "2016-10-28T20:04:11.000Z",
|
|
"first_observed": "2016-10-28T20:04:11Z",
|
|
"last_observed": "2016-10-28T20:04:11Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af3b-f1cc-438e-8bd5-437702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af3b-f1cc-438e-8bd5-437702de0b81",
|
|
"value": "https://www.virustotal.com/file/81f1925eb2b49a0f18a6036a0cfd0385f1405d6fa0ee7a80f4162a9c6eefc5a9/analysis/1476620005/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3c-5474-4aae-a146-41dd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:12.000Z",
|
|
"modified": "2016-10-28T20:04:12.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 550b9b4c5b2dbe83fa3e227cca65b9b9768e2ea597c2e109205dba51faee5869",
|
|
"pattern": "[file:hashes.SHA1 = 'dbfd2cec133c3c4c45760e4ca6a04c4b20b5a564']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3c-f930-4335-b545-467002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:12.000Z",
|
|
"modified": "2016-10-28T20:04:12.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 550b9b4c5b2dbe83fa3e227cca65b9b9768e2ea597c2e109205dba51faee5869",
|
|
"pattern": "[file:hashes.MD5 = '86f0ee133fa72bc5a95bb7001adeee69']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af3d-0bf0-4668-a794-4f0f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:13.000Z",
|
|
"modified": "2016-10-28T20:04:13.000Z",
|
|
"first_observed": "2016-10-28T20:04:13Z",
|
|
"last_observed": "2016-10-28T20:04:13Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af3d-0bf0-4668-a794-4f0f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af3d-0bf0-4668-a794-4f0f02de0b81",
|
|
"value": "https://www.virustotal.com/file/550b9b4c5b2dbe83fa3e227cca65b9b9768e2ea597c2e109205dba51faee5869/analysis/1471386072/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3d-9eb4-4d20-909b-4e2c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:13.000Z",
|
|
"modified": "2016-10-28T20:04:13.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 69402f4bd7718a3403f1caaaa387edc70b299f6aecc06de39e3a9ac28873a184",
|
|
"pattern": "[file:hashes.SHA1 = '0a1e1a134dffc7137b933934d1e76a6a58cc659a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3e-1ffc-48e8-b9f2-480902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:14.000Z",
|
|
"modified": "2016-10-28T20:04:14.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 69402f4bd7718a3403f1caaaa387edc70b299f6aecc06de39e3a9ac28873a184",
|
|
"pattern": "[file:hashes.MD5 = 'ce29fb5d0d66154054effd740dbbd9ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af3e-ea5c-443d-9d87-4e8502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:14.000Z",
|
|
"modified": "2016-10-28T20:04:14.000Z",
|
|
"first_observed": "2016-10-28T20:04:14Z",
|
|
"last_observed": "2016-10-28T20:04:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af3e-ea5c-443d-9d87-4e8502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af3e-ea5c-443d-9d87-4e8502de0b81",
|
|
"value": "https://www.virustotal.com/file/69402f4bd7718a3403f1caaaa387edc70b299f6aecc06de39e3a9ac28873a184/analysis/1472712579/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3f-9e3c-4f25-85f1-405e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:15.000Z",
|
|
"modified": "2016-10-28T20:04:15.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 40c882738ea1e01cc4e8027dd6ce5d55552e5630c8f65e86db630fca09d85fa9",
|
|
"pattern": "[file:hashes.SHA1 = '4f70ce5c2a9eb66b98882c4a250aba4b03cab88f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af3f-ace8-4bbb-ad8d-450802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:15.000Z",
|
|
"modified": "2016-10-28T20:04:15.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 40c882738ea1e01cc4e8027dd6ce5d55552e5630c8f65e86db630fca09d85fa9",
|
|
"pattern": "[file:hashes.MD5 = 'a7d825310632c49d9f50134dfaddd718']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af40-b5cc-4584-833b-4fde02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:16.000Z",
|
|
"modified": "2016-10-28T20:04:16.000Z",
|
|
"first_observed": "2016-10-28T20:04:16Z",
|
|
"last_observed": "2016-10-28T20:04:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af40-b5cc-4584-833b-4fde02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af40-b5cc-4584-833b-4fde02de0b81",
|
|
"value": "https://www.virustotal.com/file/40c882738ea1e01cc4e8027dd6ce5d55552e5630c8f65e86db630fca09d85fa9/analysis/1472712468/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af40-a824-4a92-9134-499b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:16.000Z",
|
|
"modified": "2016-10-28T20:04:16.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dbb7c4548d49207eb772ff85657a7d9a0eeec24efb6e3b85f5dc94207df4a223",
|
|
"pattern": "[file:hashes.SHA1 = 'bba1b9763b26438d6897fc4336ff5add167f73b7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af41-a700-4ab2-bb9a-448702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:17.000Z",
|
|
"modified": "2016-10-28T20:04:17.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dbb7c4548d49207eb772ff85657a7d9a0eeec24efb6e3b85f5dc94207df4a223",
|
|
"pattern": "[file:hashes.MD5 = 'f7567c8c6597a85065d9db7bd2c8f9da']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af41-3e04-4c01-87b1-42f402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:17.000Z",
|
|
"modified": "2016-10-28T20:04:17.000Z",
|
|
"first_observed": "2016-10-28T20:04:17Z",
|
|
"last_observed": "2016-10-28T20:04:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af41-3e04-4c01-87b1-42f402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af41-3e04-4c01-87b1-42f402de0b81",
|
|
"value": "https://www.virustotal.com/file/dbb7c4548d49207eb772ff85657a7d9a0eeec24efb6e3b85f5dc94207df4a223/analysis/1474388102/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af42-9428-4b48-9188-4dd602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:18.000Z",
|
|
"modified": "2016-10-28T20:04:18.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 09f1967e97a97a1d0963a84823fa2611b9555866f09d7a04bb69bc4d877f9631",
|
|
"pattern": "[file:hashes.SHA1 = 'a190cf18ae76f4d5803851683c7731f72d8ba3bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af42-0324-4a8f-a62f-4f3602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:18.000Z",
|
|
"modified": "2016-10-28T20:04:18.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 09f1967e97a97a1d0963a84823fa2611b9555866f09d7a04bb69bc4d877f9631",
|
|
"pattern": "[file:hashes.MD5 = '5f00ede30c4fabc8f17182e81890d170']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af43-fb98-4a5e-8632-457402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:19.000Z",
|
|
"modified": "2016-10-28T20:04:19.000Z",
|
|
"first_observed": "2016-10-28T20:04:19Z",
|
|
"last_observed": "2016-10-28T20:04:19Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af43-fb98-4a5e-8632-457402de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af43-fb98-4a5e-8632-457402de0b81",
|
|
"value": "https://www.virustotal.com/file/09f1967e97a97a1d0963a84823fa2611b9555866f09d7a04bb69bc4d877f9631/analysis/1472712609/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af43-ada8-4abe-921d-4f8802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:19.000Z",
|
|
"modified": "2016-10-28T20:04:19.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c058d576a108bdcf637a6ed399b4d9a1e3bbb6f194882ffada01b85e79109f65",
|
|
"pattern": "[file:hashes.SHA1 = 'a2eca13110524e4f29e2641d02fbb2411617c0d6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af44-0ae4-4628-a78f-418c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:20.000Z",
|
|
"modified": "2016-10-28T20:04:20.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: c058d576a108bdcf637a6ed399b4d9a1e3bbb6f194882ffada01b85e79109f65",
|
|
"pattern": "[file:hashes.MD5 = '5ea6d08c158143faa3ba527580a3134a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af44-8204-4740-ae4b-4bce02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:20.000Z",
|
|
"modified": "2016-10-28T20:04:20.000Z",
|
|
"first_observed": "2016-10-28T20:04:20Z",
|
|
"last_observed": "2016-10-28T20:04:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af44-8204-4740-ae4b-4bce02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af44-8204-4740-ae4b-4bce02de0b81",
|
|
"value": "https://www.virustotal.com/file/c058d576a108bdcf637a6ed399b4d9a1e3bbb6f194882ffada01b85e79109f65/analysis/1472712470/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af45-0028-4e87-b5f1-403902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:21.000Z",
|
|
"modified": "2016-10-28T20:04:21.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2934da8eb30d59c001767fb8e28ccb728af8b2c8b8258a7453b85a5b0e340254",
|
|
"pattern": "[file:hashes.SHA1 = '2164b9d7d81099f33fa49442b1663ba3469860ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af45-c3e0-48b9-a2b3-43c902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:21.000Z",
|
|
"modified": "2016-10-28T20:04:21.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2934da8eb30d59c001767fb8e28ccb728af8b2c8b8258a7453b85a5b0e340254",
|
|
"pattern": "[file:hashes.MD5 = '47815dca124a59112294146a6b17c3b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af46-97ec-4824-9351-4c5002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:22.000Z",
|
|
"modified": "2016-10-28T20:04:22.000Z",
|
|
"first_observed": "2016-10-28T20:04:22Z",
|
|
"last_observed": "2016-10-28T20:04:22Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af46-97ec-4824-9351-4c5002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af46-97ec-4824-9351-4c5002de0b81",
|
|
"value": "https://www.virustotal.com/file/2934da8eb30d59c001767fb8e28ccb728af8b2c8b8258a7453b85a5b0e340254/analysis/1474899868/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af46-1338-46ce-930e-4ae202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:22.000Z",
|
|
"modified": "2016-10-28T20:04:22.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1b2ff46200ed68a210ae3a406777f6d762b5de91ab335fa6766e6514c33200e9",
|
|
"pattern": "[file:hashes.SHA1 = '48329af7c1a86963addb10e9a417c9e584f1186e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af47-6bec-4851-969f-410002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:23.000Z",
|
|
"modified": "2016-10-28T20:04:23.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1b2ff46200ed68a210ae3a406777f6d762b5de91ab335fa6766e6514c33200e9",
|
|
"pattern": "[file:hashes.MD5 = '7f2f66cdb256938a131baae3bee15086']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af47-a41c-4684-81a3-440902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:23.000Z",
|
|
"modified": "2016-10-28T20:04:23.000Z",
|
|
"first_observed": "2016-10-28T20:04:23Z",
|
|
"last_observed": "2016-10-28T20:04:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af47-a41c-4684-81a3-440902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af47-a41c-4684-81a3-440902de0b81",
|
|
"value": "https://www.virustotal.com/file/1b2ff46200ed68a210ae3a406777f6d762b5de91ab335fa6766e6514c33200e9/analysis/1476617226/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af48-2ff4-45b9-a2b3-412202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:24.000Z",
|
|
"modified": "2016-10-28T20:04:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 6428046c24aace0575c1a1443eedb7abe92ccde0fdc1f83827a54306959d0f3c",
|
|
"pattern": "[file:hashes.SHA1 = '8620fdc291007f4e429b58e132b3b2b13261fddd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af48-a16c-4aaa-bda5-4ef302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:24.000Z",
|
|
"modified": "2016-10-28T20:04:24.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 6428046c24aace0575c1a1443eedb7abe92ccde0fdc1f83827a54306959d0f3c",
|
|
"pattern": "[file:hashes.MD5 = 'e0bf7bff67dfe9b5273ad59dc7d611dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af49-3d84-4b5e-97e7-4cd502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:25.000Z",
|
|
"modified": "2016-10-28T20:04:25.000Z",
|
|
"first_observed": "2016-10-28T20:04:25Z",
|
|
"last_observed": "2016-10-28T20:04:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af49-3d84-4b5e-97e7-4cd502de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af49-3d84-4b5e-97e7-4cd502de0b81",
|
|
"value": "https://www.virustotal.com/file/6428046c24aace0575c1a1443eedb7abe92ccde0fdc1f83827a54306959d0f3c/analysis/1476618617/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af49-2544-4aea-9b24-48c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:25.000Z",
|
|
"modified": "2016-10-28T20:04:25.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 192a67ed44d5e7fd33ba80b90abf69e2af8a60f32cf89d77ef0dc93425695867",
|
|
"pattern": "[file:hashes.SHA1 = '0c6e53bf1e7a1b8111b32872307c090270b0bfe9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4a-6934-418d-b80b-482f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:26.000Z",
|
|
"modified": "2016-10-28T20:04:26.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 192a67ed44d5e7fd33ba80b90abf69e2af8a60f32cf89d77ef0dc93425695867",
|
|
"pattern": "[file:hashes.MD5 = '27b7d05ddc79bd21c7067dee5923dd2f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af4a-2ef0-4da3-9b11-4e9d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:26.000Z",
|
|
"modified": "2016-10-28T20:04:26.000Z",
|
|
"first_observed": "2016-10-28T20:04:26Z",
|
|
"last_observed": "2016-10-28T20:04:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af4a-2ef0-4da3-9b11-4e9d02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af4a-2ef0-4da3-9b11-4e9d02de0b81",
|
|
"value": "https://www.virustotal.com/file/192a67ed44d5e7fd33ba80b90abf69e2af8a60f32cf89d77ef0dc93425695867/analysis/1476619549/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4b-1fe4-44ec-a100-415e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:27.000Z",
|
|
"modified": "2016-10-28T20:04:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3e4cebd60a1d6a6b29bac68ace2547c2e3894a0e5865dd90aff5764f8e7dc16d",
|
|
"pattern": "[file:hashes.SHA1 = '8f8e1e42b1fac09f2f4449ac93113a779dad744e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4b-69e4-41e0-83c6-4c4f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:27.000Z",
|
|
"modified": "2016-10-28T20:04:27.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3e4cebd60a1d6a6b29bac68ace2547c2e3894a0e5865dd90aff5764f8e7dc16d",
|
|
"pattern": "[file:hashes.MD5 = 'bb29d31ecfa263e2d9bc8fefae8c3c4c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af4c-11bc-48ae-b6e5-4f7a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:28.000Z",
|
|
"modified": "2016-10-28T20:04:28.000Z",
|
|
"first_observed": "2016-10-28T20:04:28Z",
|
|
"last_observed": "2016-10-28T20:04:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af4c-11bc-48ae-b6e5-4f7a02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af4c-11bc-48ae-b6e5-4f7a02de0b81",
|
|
"value": "https://www.virustotal.com/file/3e4cebd60a1d6a6b29bac68ace2547c2e3894a0e5865dd90aff5764f8e7dc16d/analysis/1472712673/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4c-2910-4fdb-a1aa-4d7b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:28.000Z",
|
|
"modified": "2016-10-28T20:04:28.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 52bf6ae8fe7a0a59ca8d089444207c173e20a7a11c8b5e815b937e2f4224da4f",
|
|
"pattern": "[file:hashes.SHA1 = '44e2de941b5e7300d7d6a58a36a5a8cf22fbb621']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4d-4c7c-4822-b248-46df02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:29.000Z",
|
|
"modified": "2016-10-28T20:04:29.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 52bf6ae8fe7a0a59ca8d089444207c173e20a7a11c8b5e815b937e2f4224da4f",
|
|
"pattern": "[file:hashes.MD5 = 'ac72eea1a88b97c89a9c6d8a50cfe154']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af4d-69f0-4015-a497-489e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:29.000Z",
|
|
"modified": "2016-10-28T20:04:29.000Z",
|
|
"first_observed": "2016-10-28T20:04:29Z",
|
|
"last_observed": "2016-10-28T20:04:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af4d-69f0-4015-a497-489e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af4d-69f0-4015-a497-489e02de0b81",
|
|
"value": "https://www.virustotal.com/file/52bf6ae8fe7a0a59ca8d089444207c173e20a7a11c8b5e815b937e2f4224da4f/analysis/1472712441/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4e-ae44-4c69-a045-498802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:30.000Z",
|
|
"modified": "2016-10-28T20:04:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0723de24bc86eedde149c53e0f93a18596bed424e823f1b46c2f97e358931b83",
|
|
"pattern": "[file:hashes.SHA1 = '261fd77a9e6d780959965e666926b0b3f2a79d15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4e-624c-4fa9-8bd8-47f102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:30.000Z",
|
|
"modified": "2016-10-28T20:04:30.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 0723de24bc86eedde149c53e0f93a18596bed424e823f1b46c2f97e358931b83",
|
|
"pattern": "[file:hashes.MD5 = '4b0a25263066fc6fc17a3a7a839f7ba8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af4f-b468-4b8e-b6ba-4b3102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:31.000Z",
|
|
"modified": "2016-10-28T20:04:31.000Z",
|
|
"first_observed": "2016-10-28T20:04:31Z",
|
|
"last_observed": "2016-10-28T20:04:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af4f-b468-4b8e-b6ba-4b3102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af4f-b468-4b8e-b6ba-4b3102de0b81",
|
|
"value": "https://www.virustotal.com/file/0723de24bc86eedde149c53e0f93a18596bed424e823f1b46c2f97e358931b83/analysis/1472712465/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af4f-83a0-4eb8-bef5-4a9a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:31.000Z",
|
|
"modified": "2016-10-28T20:04:31.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3da2ddcef59f12f4879de1c6a0f1c6f016b1042ad2639ec2c4aa12b9c315d10f",
|
|
"pattern": "[file:hashes.SHA1 = '7bda7d76d512c6cc0a7e4074c73e91b5c717e210']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af50-40b4-4bd8-ae33-4df102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:32.000Z",
|
|
"modified": "2016-10-28T20:04:32.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3da2ddcef59f12f4879de1c6a0f1c6f016b1042ad2639ec2c4aa12b9c315d10f",
|
|
"pattern": "[file:hashes.MD5 = 'fcb6316f41751498a6b2f518b47e6bc3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af50-f608-406c-bd67-48e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:32.000Z",
|
|
"modified": "2016-10-28T20:04:32.000Z",
|
|
"first_observed": "2016-10-28T20:04:32Z",
|
|
"last_observed": "2016-10-28T20:04:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af50-f608-406c-bd67-48e202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af50-f608-406c-bd67-48e202de0b81",
|
|
"value": "https://www.virustotal.com/file/3da2ddcef59f12f4879de1c6a0f1c6f016b1042ad2639ec2c4aa12b9c315d10f/analysis/1472710794/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af51-2040-4a74-a1fd-437502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:32.000Z",
|
|
"modified": "2016-10-28T20:04:32.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a1610e735042ce0197859e6fd7772039e63efce78d6c9cf642492d1c8f1d7540",
|
|
"pattern": "[file:hashes.SHA1 = '385a3631b7e67d101f7a896d7f821c26d67b72a6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af51-f4cc-41d7-9662-4e4802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:33.000Z",
|
|
"modified": "2016-10-28T20:04:33.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: a1610e735042ce0197859e6fd7772039e63efce78d6c9cf642492d1c8f1d7540",
|
|
"pattern": "[file:hashes.MD5 = '92544ccc25cc3a2da956bf41b2331c98']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af51-1a18-45b8-8637-428f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:33.000Z",
|
|
"modified": "2016-10-28T20:04:33.000Z",
|
|
"first_observed": "2016-10-28T20:04:33Z",
|
|
"last_observed": "2016-10-28T20:04:33Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af51-1a18-45b8-8637-428f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af51-1a18-45b8-8637-428f02de0b81",
|
|
"value": "https://www.virustotal.com/file/a1610e735042ce0197859e6fd7772039e63efce78d6c9cf642492d1c8f1d7540/analysis/1472712604/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af52-f52c-4df2-815c-4f8c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:34.000Z",
|
|
"modified": "2016-10-28T20:04:34.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d24ca01f15e7b341eb2fcc0e83a55f0c2d87343bd7c018a5236ca58040a91466",
|
|
"pattern": "[file:hashes.SHA1 = '1eb1bea06ab85043239c86973da07121492796c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af52-2cc4-4670-969a-4af802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:34.000Z",
|
|
"modified": "2016-10-28T20:04:34.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d24ca01f15e7b341eb2fcc0e83a55f0c2d87343bd7c018a5236ca58040a91466",
|
|
"pattern": "[file:hashes.MD5 = 'de9af6667bdba6d4d40ec196d2f2c8f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af53-6d90-4649-b332-46d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:35.000Z",
|
|
"modified": "2016-10-28T20:04:35.000Z",
|
|
"first_observed": "2016-10-28T20:04:35Z",
|
|
"last_observed": "2016-10-28T20:04:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af53-6d90-4649-b332-46d802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af53-6d90-4649-b332-46d802de0b81",
|
|
"value": "https://www.virustotal.com/file/d24ca01f15e7b341eb2fcc0e83a55f0c2d87343bd7c018a5236ca58040a91466/analysis/1476618852/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af53-8b54-4009-8f9c-4f3302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:35.000Z",
|
|
"modified": "2016-10-28T20:04:35.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 08f8a4dad2ddb9e44b3371634157f302966b930f4a07504f1a7f9ba70b5310f6",
|
|
"pattern": "[file:hashes.SHA1 = '8a2923afb58e05684bd4beac040137377e3de30b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af54-5e2c-4e3f-b671-488c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:36.000Z",
|
|
"modified": "2016-10-28T20:04:36.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 08f8a4dad2ddb9e44b3371634157f302966b930f4a07504f1a7f9ba70b5310f6",
|
|
"pattern": "[file:hashes.MD5 = 'e29b69483ba2e2e5119d9089eebb7bcb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af54-7c74-40d7-9bb1-493e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:36.000Z",
|
|
"modified": "2016-10-28T20:04:36.000Z",
|
|
"first_observed": "2016-10-28T20:04:36Z",
|
|
"last_observed": "2016-10-28T20:04:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af54-7c74-40d7-9bb1-493e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af54-7c74-40d7-9bb1-493e02de0b81",
|
|
"value": "https://www.virustotal.com/file/08f8a4dad2ddb9e44b3371634157f302966b930f4a07504f1a7f9ba70b5310f6/analysis/1472712879/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af55-9924-4703-b53c-4dc902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:37.000Z",
|
|
"modified": "2016-10-28T20:04:37.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2f6c54a9cb83dc72cfd14809db9d394daaa3bca1dc0b5ff73ba13501e9407ec6",
|
|
"pattern": "[file:hashes.SHA1 = '9f5dafa9b9a9c8b5690d60e1ab96b6b21ecab550']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af55-a294-4fc2-b7d7-439402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:37.000Z",
|
|
"modified": "2016-10-28T20:04:37.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2f6c54a9cb83dc72cfd14809db9d394daaa3bca1dc0b5ff73ba13501e9407ec6",
|
|
"pattern": "[file:hashes.MD5 = '03d0ae54c79f56fbd6dbaed9947338a8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af56-32b0-4631-a3e2-4e1602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:38.000Z",
|
|
"modified": "2016-10-28T20:04:38.000Z",
|
|
"first_observed": "2016-10-28T20:04:38Z",
|
|
"last_observed": "2016-10-28T20:04:38Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af56-32b0-4631-a3e2-4e1602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af56-32b0-4631-a3e2-4e1602de0b81",
|
|
"value": "https://www.virustotal.com/file/2f6c54a9cb83dc72cfd14809db9d394daaa3bca1dc0b5ff73ba13501e9407ec6/analysis/1475486445/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af56-b6cc-4bc0-ba1e-4f4902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:38.000Z",
|
|
"modified": "2016-10-28T20:04:38.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b26781cc1011c7a844e512ad88213ea64e3470d21eda73287b8c1d6c0370dae1",
|
|
"pattern": "[file:hashes.SHA1 = '7af7fc0974fd13548dee4c7dd473bfc7f4951e7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af57-5b04-489a-96a8-4e6102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:39.000Z",
|
|
"modified": "2016-10-28T20:04:39.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: b26781cc1011c7a844e512ad88213ea64e3470d21eda73287b8c1d6c0370dae1",
|
|
"pattern": "[file:hashes.MD5 = '7c289965922239d029458551d7790dff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af57-80a0-4f6a-8c82-4e1b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:39.000Z",
|
|
"modified": "2016-10-28T20:04:39.000Z",
|
|
"first_observed": "2016-10-28T20:04:39Z",
|
|
"last_observed": "2016-10-28T20:04:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af57-80a0-4f6a-8c82-4e1b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af57-80a0-4f6a-8c82-4e1b02de0b81",
|
|
"value": "https://www.virustotal.com/file/b26781cc1011c7a844e512ad88213ea64e3470d21eda73287b8c1d6c0370dae1/analysis/1476618190/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af58-b538-4b8a-981f-41de02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:40.000Z",
|
|
"modified": "2016-10-28T20:04:40.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 06fe8decf5dfd6fe0655ff6e5156576666a7a536f53cfa2013b8d9ca11e76a84",
|
|
"pattern": "[file:hashes.SHA1 = '2a771ebc7aa35c323dd5898f48c2dc663a5db910']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af58-d36c-4b0b-b8a3-4edc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:40.000Z",
|
|
"modified": "2016-10-28T20:04:40.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 06fe8decf5dfd6fe0655ff6e5156576666a7a536f53cfa2013b8d9ca11e76a84",
|
|
"pattern": "[file:hashes.MD5 = '7778dc80a59abfff4899426cc8732a60']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af59-7210-4aa8-87cd-466602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:41.000Z",
|
|
"modified": "2016-10-28T20:04:41.000Z",
|
|
"first_observed": "2016-10-28T20:04:41Z",
|
|
"last_observed": "2016-10-28T20:04:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af59-7210-4aa8-87cd-466602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af59-7210-4aa8-87cd-466602de0b81",
|
|
"value": "https://www.virustotal.com/file/06fe8decf5dfd6fe0655ff6e5156576666a7a536f53cfa2013b8d9ca11e76a84/analysis/1474113896/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af59-cee4-4dee-b2e6-4ad102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:41.000Z",
|
|
"modified": "2016-10-28T20:04:41.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: aa27d4ec34eb9ff93f99a3d8108e29c28b43c3719dacbe95f44c3476a142d457",
|
|
"pattern": "[file:hashes.SHA1 = 'a6a92f8094151af27875c55456a4f4e3686d5468']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5a-9cfc-417b-9d76-49b802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:42.000Z",
|
|
"modified": "2016-10-28T20:04:42.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: aa27d4ec34eb9ff93f99a3d8108e29c28b43c3719dacbe95f44c3476a142d457",
|
|
"pattern": "[file:hashes.MD5 = '33969ad4a7234bde3008756a816b52a9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af5a-0d90-4cac-9908-47c802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:42.000Z",
|
|
"modified": "2016-10-28T20:04:42.000Z",
|
|
"first_observed": "2016-10-28T20:04:42Z",
|
|
"last_observed": "2016-10-28T20:04:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af5a-0d90-4cac-9908-47c802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af5a-0d90-4cac-9908-47c802de0b81",
|
|
"value": "https://www.virustotal.com/file/aa27d4ec34eb9ff93f99a3d8108e29c28b43c3719dacbe95f44c3476a142d457/analysis/1476620464/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5b-7738-4b91-9890-467502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:43.000Z",
|
|
"modified": "2016-10-28T20:04:43.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ddb19f88a0f8b9f86c9b6ec5ef5bdd01a026b0ca65d59cc38fbb2b4c42811296",
|
|
"pattern": "[file:hashes.SHA1 = 'bcf338aea20d649d056821f686913ba29abe6924']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5b-6854-4a46-88fb-45a002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:43.000Z",
|
|
"modified": "2016-10-28T20:04:43.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: ddb19f88a0f8b9f86c9b6ec5ef5bdd01a026b0ca65d59cc38fbb2b4c42811296",
|
|
"pattern": "[file:hashes.MD5 = '0a2e0844e6d54e6e0349faea4c1dc378']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af5c-5650-48f9-8248-470c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:44.000Z",
|
|
"modified": "2016-10-28T20:04:44.000Z",
|
|
"first_observed": "2016-10-28T20:04:44Z",
|
|
"last_observed": "2016-10-28T20:04:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af5c-5650-48f9-8248-470c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af5c-5650-48f9-8248-470c02de0b81",
|
|
"value": "https://www.virustotal.com/file/ddb19f88a0f8b9f86c9b6ec5ef5bdd01a026b0ca65d59cc38fbb2b4c42811296/analysis/1472712969/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5c-a204-4502-8466-475302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:44.000Z",
|
|
"modified": "2016-10-28T20:04:44.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3f53926f825d1f17999745983654cce4adb6d106d913d337920c41cc8a857a4d",
|
|
"pattern": "[file:hashes.SHA1 = 'ab35963937ecc8c182564c9be27baf378544d2e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5d-da64-4206-ba70-429702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:45.000Z",
|
|
"modified": "2016-10-28T20:04:45.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 3f53926f825d1f17999745983654cce4adb6d106d913d337920c41cc8a857a4d",
|
|
"pattern": "[file:hashes.MD5 = '082ccde898b198b52a7d14fe06061b07']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af5d-3e14-4f73-9035-495802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:45.000Z",
|
|
"modified": "2016-10-28T20:04:45.000Z",
|
|
"first_observed": "2016-10-28T20:04:45Z",
|
|
"last_observed": "2016-10-28T20:04:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af5d-3e14-4f73-9035-495802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af5d-3e14-4f73-9035-495802de0b81",
|
|
"value": "https://www.virustotal.com/file/3f53926f825d1f17999745983654cce4adb6d106d913d337920c41cc8a857a4d/analysis/1476617067/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5e-64c8-4605-93de-438502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:46.000Z",
|
|
"modified": "2016-10-28T20:04:46.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dcd0e1586630bc8c50fe600899bee76b853057fd9158ed541d7ddec53c8f2186",
|
|
"pattern": "[file:hashes.SHA1 = 'fdec6599d8627fc37bcb029f69a1ac9c4ac739bf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5e-4738-46a1-9fa8-416b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:46.000Z",
|
|
"modified": "2016-10-28T20:04:46.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: dcd0e1586630bc8c50fe600899bee76b853057fd9158ed541d7ddec53c8f2186",
|
|
"pattern": "[file:hashes.MD5 = '82728dc807ce4f8bfe868c1a0b7900b9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af5f-0610-45a6-b821-4fcc02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:47.000Z",
|
|
"modified": "2016-10-28T20:04:47.000Z",
|
|
"first_observed": "2016-10-28T20:04:47Z",
|
|
"last_observed": "2016-10-28T20:04:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af5f-0610-45a6-b821-4fcc02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af5f-0610-45a6-b821-4fcc02de0b81",
|
|
"value": "https://www.virustotal.com/file/dcd0e1586630bc8c50fe600899bee76b853057fd9158ed541d7ddec53c8f2186/analysis/1472712519/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af5f-ea18-44b5-89ad-4eb702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:47.000Z",
|
|
"modified": "2016-10-28T20:04:47.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9909910d6e008e15c98d26e214f619a7a82787137158784998d99b5c03cbe8f2",
|
|
"pattern": "[file:hashes.SHA1 = '53585362ef71f957c129676095795fe33ed09a68']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af60-69ec-4fdd-b67e-486502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:48.000Z",
|
|
"modified": "2016-10-28T20:04:48.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 9909910d6e008e15c98d26e214f619a7a82787137158784998d99b5c03cbe8f2",
|
|
"pattern": "[file:hashes.MD5 = 'd5254af12d62e9997475361f9d492642']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af60-cab4-4d1d-b29f-4e6e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:48.000Z",
|
|
"modified": "2016-10-28T20:04:48.000Z",
|
|
"first_observed": "2016-10-28T20:04:48Z",
|
|
"last_observed": "2016-10-28T20:04:48Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af60-cab4-4d1d-b29f-4e6e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af60-cab4-4d1d-b29f-4e6e02de0b81",
|
|
"value": "https://www.virustotal.com/file/9909910d6e008e15c98d26e214f619a7a82787137158784998d99b5c03cbe8f2/analysis/1472712589/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af61-ca98-480a-bdc3-4ba702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:49.000Z",
|
|
"modified": "2016-10-28T20:04:49.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 444284e41eea3dae1771d25c3e18d0bf8f85e3cb3658d2c3b91ea685f139bf4b",
|
|
"pattern": "[file:hashes.SHA1 = '4e4b3c673744af94d9feb6ffc89ffc1304bbbdd0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af61-9d28-4c31-affa-415002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:49.000Z",
|
|
"modified": "2016-10-28T20:04:49.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 444284e41eea3dae1771d25c3e18d0bf8f85e3cb3658d2c3b91ea685f139bf4b",
|
|
"pattern": "[file:hashes.MD5 = '7d3c6befe20f3a11270eab53e2261018']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af62-ca7c-453b-80db-4b6f02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:50.000Z",
|
|
"modified": "2016-10-28T20:04:50.000Z",
|
|
"first_observed": "2016-10-28T20:04:50Z",
|
|
"last_observed": "2016-10-28T20:04:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af62-ca7c-453b-80db-4b6f02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af62-ca7c-453b-80db-4b6f02de0b81",
|
|
"value": "https://www.virustotal.com/file/444284e41eea3dae1771d25c3e18d0bf8f85e3cb3658d2c3b91ea685f139bf4b/analysis/1476618742/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af62-33f4-4ac6-a77b-4e9902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:50.000Z",
|
|
"modified": "2016-10-28T20:04:50.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d67ae5639618a3409711377e124ef2c6293200aa3026b8b2996654db63645481",
|
|
"pattern": "[file:hashes.SHA1 = 'ee4173cc2a14d380920dd0e8312fc9c26aa13788']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af63-e4c8-48d9-abde-48d002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:51.000Z",
|
|
"modified": "2016-10-28T20:04:51.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: d67ae5639618a3409711377e124ef2c6293200aa3026b8b2996654db63645481",
|
|
"pattern": "[file:hashes.MD5 = '71c7d77f2bf13f25d08c8263cfc9280b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af63-e12c-4a61-ac35-4fff02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:51.000Z",
|
|
"modified": "2016-10-28T20:04:51.000Z",
|
|
"first_observed": "2016-10-28T20:04:51Z",
|
|
"last_observed": "2016-10-28T20:04:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af63-e12c-4a61-ac35-4fff02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af63-e12c-4a61-ac35-4fff02de0b81",
|
|
"value": "https://www.virustotal.com/file/d67ae5639618a3409711377e124ef2c6293200aa3026b8b2996654db63645481/analysis/1472712512/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af64-e2a0-43cd-b35d-4c3502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:52.000Z",
|
|
"modified": "2016-10-28T20:04:52.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1fd98eabd378aa0526a362499c14bb8c5146c2615ee4a3731146fd61bdca36b1",
|
|
"pattern": "[file:hashes.SHA1 = '63398c7a8ed6c5b384149eb8515649cdf988e6e4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af64-fa50-4ad6-9131-4b7302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:52.000Z",
|
|
"modified": "2016-10-28T20:04:52.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 1fd98eabd378aa0526a362499c14bb8c5146c2615ee4a3731146fd61bdca36b1",
|
|
"pattern": "[file:hashes.MD5 = 'd5e2bb43d7026c2a12b257b634a9ed7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af65-55b0-43ed-94cc-48e202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:53.000Z",
|
|
"modified": "2016-10-28T20:04:53.000Z",
|
|
"first_observed": "2016-10-28T20:04:53Z",
|
|
"last_observed": "2016-10-28T20:04:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af65-55b0-43ed-94cc-48e202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af65-55b0-43ed-94cc-48e202de0b81",
|
|
"value": "https://www.virustotal.com/file/1fd98eabd378aa0526a362499c14bb8c5146c2615ee4a3731146fd61bdca36b1/analysis/1476619349/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af65-ce44-400b-a6e0-497102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:53.000Z",
|
|
"modified": "2016-10-28T20:04:53.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2cca695f859b3fddf0e934c6b05334ad940aae288061b83ddab786fcb24d2ae0",
|
|
"pattern": "[file:hashes.SHA1 = '959c66dd7d1b5d470d3d7c26ea2219a788c26c4f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af66-fed8-4747-9bad-495302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:54.000Z",
|
|
"modified": "2016-10-28T20:04:54.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 2cca695f859b3fddf0e934c6b05334ad940aae288061b83ddab786fcb24d2ae0",
|
|
"pattern": "[file:hashes.MD5 = 'f9fe47f393ff543ec8a110f6342ddd61']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af66-9844-4edd-98b8-46ad02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:54.000Z",
|
|
"modified": "2016-10-28T20:04:54.000Z",
|
|
"first_observed": "2016-10-28T20:04:54Z",
|
|
"last_observed": "2016-10-28T20:04:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af66-9844-4edd-98b8-46ad02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af66-9844-4edd-98b8-46ad02de0b81",
|
|
"value": "https://www.virustotal.com/file/2cca695f859b3fddf0e934c6b05334ad940aae288061b83ddab786fcb24d2ae0/analysis/1475906154/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af67-852c-4695-9c64-480302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:55.000Z",
|
|
"modified": "2016-10-28T20:04:55.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 71d8d1a50db2bf3edce85ae5e5614dac63f9c7d2efd6494956dc8b7af3513e8d",
|
|
"pattern": "[file:hashes.SHA1 = '0f9a97dd5cdc570b4bfb34abd58f4c9084d370e0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af67-b088-4628-a97e-4c8602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:55.000Z",
|
|
"modified": "2016-10-28T20:04:55.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 71d8d1a50db2bf3edce85ae5e5614dac63f9c7d2efd6494956dc8b7af3513e8d",
|
|
"pattern": "[file:hashes.MD5 = 'fea8d7059b0cf5887438d9c9b2c55979']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af68-7af4-44c6-a18a-431902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:56.000Z",
|
|
"modified": "2016-10-28T20:04:56.000Z",
|
|
"first_observed": "2016-10-28T20:04:56Z",
|
|
"last_observed": "2016-10-28T20:04:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af68-7af4-44c6-a18a-431902de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af68-7af4-44c6-a18a-431902de0b81",
|
|
"value": "https://www.virustotal.com/file/71d8d1a50db2bf3edce85ae5e5614dac63f9c7d2efd6494956dc8b7af3513e8d/analysis/1476619424/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af68-a350-44e3-a145-458702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:56.000Z",
|
|
"modified": "2016-10-28T20:04:56.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 762a4f2bf5ea4ff72fce674da1adf29f0b9357be18de4cd992d79198c56bb514",
|
|
"pattern": "[file:hashes.SHA1 = '98172e49c3d5d70ffdcefd071f9762c58430a393']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af69-6480-4d07-a261-4c7702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:57.000Z",
|
|
"modified": "2016-10-28T20:04:57.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 762a4f2bf5ea4ff72fce674da1adf29f0b9357be18de4cd992d79198c56bb514",
|
|
"pattern": "[file:hashes.MD5 = '5bd44a35094fe6f7794d895122ddfa62']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af69-0238-4ce8-8f1b-44f602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:57.000Z",
|
|
"modified": "2016-10-28T20:04:57.000Z",
|
|
"first_observed": "2016-10-28T20:04:57Z",
|
|
"last_observed": "2016-10-28T20:04:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af69-0238-4ce8-8f1b-44f602de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af69-0238-4ce8-8f1b-44f602de0b81",
|
|
"value": "https://www.virustotal.com/file/762a4f2bf5ea4ff72fce674da1adf29f0b9357be18de4cd992d79198c56bb514/analysis/1477091240/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af6a-5da0-4097-9102-43c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:58.000Z",
|
|
"modified": "2016-10-28T20:04:58.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 97c1ed3d52d663f9bad2eef716169f06053dc2bcf8e3d857b0a702e8fae546c9",
|
|
"pattern": "[file:hashes.SHA1 = '9ae1fa769d48772bdfda88da337460e6882ac6af']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af6a-ce88-49d7-b4f9-4cf902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:58.000Z",
|
|
"modified": "2016-10-28T20:04:58.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: 97c1ed3d52d663f9bad2eef716169f06053dc2bcf8e3d857b0a702e8fae546c9",
|
|
"pattern": "[file:hashes.MD5 = '0339b04c8dc2cc5c6746bd5e2261ab61']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af6a-6a54-4545-a0ac-47d802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:58.000Z",
|
|
"modified": "2016-10-28T20:04:58.000Z",
|
|
"first_observed": "2016-10-28T20:04:58Z",
|
|
"last_observed": "2016-10-28T20:04:58Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af6a-6a54-4545-a0ac-47d802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af6a-6a54-4545-a0ac-47d802de0b81",
|
|
"value": "https://www.virustotal.com/file/97c1ed3d52d663f9bad2eef716169f06053dc2bcf8e3d857b0a702e8fae546c9/analysis/1472712580/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af6b-bad8-4f72-a283-49c602de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:59.000Z",
|
|
"modified": "2016-10-28T20:04:59.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f14b398584729f13317b229f06356c7fa222c11ad916a95afe78bfc20404d6a4",
|
|
"pattern": "[file:hashes.SHA1 = '7157b9083ad35f956466b83050997b4bcd4ebb9b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5813af6b-8c6c-4ffd-9437-448c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:04:59.000Z",
|
|
"modified": "2016-10-28T20:04:59.000Z",
|
|
"description": "List of hashes (unpacked version only) - Xchecked via VT: f14b398584729f13317b229f06356c7fa222c11ad916a95afe78bfc20404d6a4",
|
|
"pattern": "[file:hashes.MD5 = '80a7f0711b3151edfdb57d195168b770']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-10-28T20:04:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5813af6c-fc80-46b7-a0d5-4a0802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2016-10-28T20:05:00.000Z",
|
|
"modified": "2016-10-28T20:05:00.000Z",
|
|
"first_observed": "2016-10-28T20:05:00Z",
|
|
"last_observed": "2016-10-28T20:05:00Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5813af6c-fc80-46b7-a0d5-4a0802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5813af6c-fc80-46b7-a0d5-4a0802de0b81",
|
|
"value": "https://www.virustotal.com/file/f14b398584729f13317b229f06356c7fa222c11ad916a95afe78bfc20404d6a4/analysis/1472712778/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |