837 lines
No EOL
36 KiB
JSON
837 lines
No EOL
36 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--58996c01-5948-4776-bc9f-4216950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-24T09:16:37.000Z",
|
|
"modified": "2017-02-24T09:16:37.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--58996c01-5948-4776-bc9f-4216950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-24T09:16:37.000Z",
|
|
"modified": "2017-02-24T09:16:37.000Z",
|
|
"name": "OSINT - When A Pony Walks Out Of A Pub",
|
|
"published": "2017-02-24T16:00:38Z",
|
|
"object_refs": [
|
|
"observed-data--58996c22-8218-4d72-8cbd-43a3950d210f",
|
|
"url--58996c22-8218-4d72-8cbd-43a3950d210f",
|
|
"x-misp-attribute--58996c33-13ac-492f-a3b9-46dc950d210f",
|
|
"indicator--58996c61-82f0-4dfb-b824-4d81950d210f",
|
|
"indicator--58996c62-0b14-4823-a56c-4514950d210f",
|
|
"indicator--58996c63-ed10-4933-944c-4faf950d210f",
|
|
"indicator--58996c64-04fc-4b79-8555-4eb9950d210f",
|
|
"indicator--58996c65-6cec-47fc-b053-48f3950d210f",
|
|
"indicator--58996c66-5c50-4199-9592-4da3950d210f",
|
|
"indicator--58996c67-5324-4a23-a81f-4fc3950d210f",
|
|
"indicator--58996c68-d6d8-4822-9a30-4e32950d210f",
|
|
"indicator--58996c69-80d0-4ecb-9a50-4d4f950d210f",
|
|
"indicator--58996c6a-0478-4c6a-9227-403a950d210f",
|
|
"indicator--58996c6a-3940-4317-bd3e-4e5c950d210f",
|
|
"indicator--58996c6b-d2f4-4906-ae76-4e1f950d210f",
|
|
"indicator--58996c6c-257c-47ee-a443-4984950d210f",
|
|
"indicator--58996ca9-42a4-4d3d-bed6-4fe0950d210f",
|
|
"indicator--58996caa-2898-4e2a-b3f3-4aa3950d210f",
|
|
"indicator--58996cab-69d4-42c5-8483-42e5950d210f",
|
|
"indicator--58996cab-b9d4-48e3-84c5-4870950d210f",
|
|
"indicator--58996cac-0e60-42b7-a43f-4814950d210f",
|
|
"indicator--58996cf8-bc7c-4413-bff0-4a1d02de0b81",
|
|
"indicator--58996cf9-51d4-4ad8-bc37-45d102de0b81",
|
|
"observed-data--58996cf9-9a7c-40df-b751-444202de0b81",
|
|
"url--58996cf9-9a7c-40df-b751-444202de0b81",
|
|
"indicator--58996cfa-64d4-402e-9ce3-4b7c02de0b81",
|
|
"indicator--58996cfb-6388-411b-a740-41a302de0b81",
|
|
"observed-data--58996cfc-d058-4024-a0de-47cb02de0b81",
|
|
"url--58996cfc-d058-4024-a0de-47cb02de0b81",
|
|
"indicator--58996cfc-e528-414d-b766-44ec02de0b81",
|
|
"indicator--58996cfd-1d94-41fd-9cca-41e102de0b81",
|
|
"observed-data--58996cfe-2598-4470-b1cf-4c8702de0b81",
|
|
"url--58996cfe-2598-4470-b1cf-4c8702de0b81",
|
|
"indicator--58996cff-b21c-4734-8788-41d702de0b81",
|
|
"indicator--58996d00-f794-49a3-98ac-481c02de0b81",
|
|
"observed-data--58996d00-630c-4917-a08e-4b8e02de0b81",
|
|
"url--58996d00-630c-4917-a08e-4b8e02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58996c22-8218-4d72-8cbd-43a3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:36.000Z",
|
|
"modified": "2017-02-07T06:45:36.000Z",
|
|
"first_observed": "2017-02-07T06:45:36Z",
|
|
"last_observed": "2017-02-07T06:45:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58996c22-8218-4d72-8cbd-43a3950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"admiralty-scale:source-reliability=\"b\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58996c22-8218-4d72-8cbd-43a3950d210f",
|
|
"value": "http://blog.talosintel.com/2017/02/pony-pub-files.html"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--58996c33-13ac-492f-a3b9-46dc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:41:55.000Z",
|
|
"modified": "2017-02-07T06:41:55.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "Talos has observed a small email campaign leveraging the use of Microsoft Publisher files. These .pub files are normally used for the publishing of documents such as newsletters, allowing users to create such documents using familiar office functions such as mail merging. Unlike other applications within the Microsoft Office suite, Microsoft Publisher does not support a 'Protected View' mode. This is a read only mode which can help end users remain protected from malicious document files. Microsoft Publisher is included and installed by default in Office 365.\r\n\r\nThe file used in this campaign was aimed at infecting the victim with the, well known, Pony malware. Whilst Pony is well documented in technical capability it has not been known to use the .pub file format until now. Pony is a credential harvesting piece of malware with other trojan capabilities. In addition to credential harvesting, it is also commonly deployed as a malware loader and used to infect systems with additional malware in multi-stage infection chains. Pony is still used heavily as the sources of multiple Pony versions leaked thus making it much easier for other malicious actors to implement Pony into their infection chain."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c61-82f0-4dfb-b824-4d81950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:41.000Z",
|
|
"modified": "2017-02-07T06:42:41.000Z",
|
|
"description": "payload",
|
|
"pattern": "[url:value = 'http://5.200.52.198/flex/3435dde3r.exe']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c62-0b14-4823-a56c-4514950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:42.000Z",
|
|
"modified": "2017-02-07T06:42:42.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://195.22.127.233/rec/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c63-ed10-4933-944c-4faf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:43.000Z",
|
|
"modified": "2017-02-07T06:42:43.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://kbfvzoboss.bid/alien/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c64-04fc-4b79-8555-4eb9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:44.000Z",
|
|
"modified": "2017-02-07T06:42:44.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://alphastand.win/alien/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c65-6cec-47fc-b053-48f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:45.000Z",
|
|
"modified": "2017-02-07T06:42:45.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://alphastand.top/alien/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c66-5c50-4199-9592-4da3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:46.000Z",
|
|
"modified": "2017-02-07T06:42:46.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://alphastand.trade/alien/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c67-5324-4a23-a81f-4fc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:47.000Z",
|
|
"modified": "2017-02-07T06:42:47.000Z",
|
|
"description": "Pony CC",
|
|
"pattern": "[url:value = 'http://195.22.127.233:80/rec/fre.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c68-d6d8-4822-9a30-4e32950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:48.000Z",
|
|
"modified": "2017-02-07T06:42:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.200.52.198']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c69-80d0-4ecb-9a50-4d4f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:49.000Z",
|
|
"modified": "2017-02-07T06:42:49.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.22.127.233']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c6a-0478-4c6a-9227-403a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:50.000Z",
|
|
"modified": "2017-02-07T06:42:50.000Z",
|
|
"pattern": "[domain-name:value = 'kbfvzoboss.bid']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c6a-3940-4317-bd3e-4e5c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:50.000Z",
|
|
"modified": "2017-02-07T06:42:50.000Z",
|
|
"pattern": "[domain-name:value = 'alphastand.win']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c6b-d2f4-4906-ae76-4e1f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:51.000Z",
|
|
"modified": "2017-02-07T06:42:51.000Z",
|
|
"pattern": "[domain-name:value = 'alphastand.top']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996c6c-257c-47ee-a443-4984950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:42:52.000Z",
|
|
"modified": "2017-02-07T06:42:52.000Z",
|
|
"pattern": "[domain-name:value = 'alphastand.trade']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:42:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996ca9-42a4-4d3d-bed6-4fe0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:43:53.000Z",
|
|
"modified": "2017-02-07T06:43:53.000Z",
|
|
"description": "skbmt_fax45.pub",
|
|
"pattern": "[file:hashes.SHA256 = '3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:43:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996caa-2898-4e2a-b3f3-4aa3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:43:54.000Z",
|
|
"modified": "2017-02-07T06:43:54.000Z",
|
|
"description": "skbmt_faxreport34.pub",
|
|
"pattern": "[file:hashes.SHA256 = '36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:43:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cab-69d4-42c5-8483-42e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:43:55.000Z",
|
|
"modified": "2017-02-07T06:43:55.000Z",
|
|
"description": "letten.js",
|
|
"pattern": "[file:hashes.SHA256 = '42d0990daba69fa5068a6910d0eac487f3d308ce7e28799a959dace8d84125d7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:43:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cab-b9d4-48e3-84c5-4870950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:43:55.000Z",
|
|
"modified": "2017-02-07T06:43:55.000Z",
|
|
"description": "payload",
|
|
"pattern": "[file:hashes.SHA256 = 'd214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:43:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cac-0e60-42b7-a43f-4814950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:43:56.000Z",
|
|
"modified": "2017-02-07T06:43:56.000Z",
|
|
"description": "payload",
|
|
"pattern": "[file:hashes.SHA256 = 'c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:43:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cf8-bc7c-4413-bff0-4a1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:12.000Z",
|
|
"modified": "2017-02-07T06:45:12.000Z",
|
|
"description": "payload - Xchecked via VT: c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991",
|
|
"pattern": "[file:hashes.SHA1 = 'b7e499be525b14b6801db2795ed631fbea7ca0bd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cf9-51d4-4ad8-bc37-45d102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:13.000Z",
|
|
"modified": "2017-02-07T06:45:13.000Z",
|
|
"description": "payload - Xchecked via VT: c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991",
|
|
"pattern": "[file:hashes.MD5 = '05c6208f08108266ab20eedd464fb05f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58996cf9-9a7c-40df-b751-444202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-24T09:16:37.000Z",
|
|
"modified": "2017-02-24T09:16:37.000Z",
|
|
"first_observed": "2017-02-24T09:16:37Z",
|
|
"last_observed": "2017-02-24T09:16:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58996cf9-9a7c-40df-b751-444202de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58996cf9-9a7c-40df-b751-444202de0b81",
|
|
"value": "https://www.virustotal.com/file/c7ef89222d760fc915690e6394c61c84176e618f7c9508beca30aa9a0f1b1991/analysis/1486387683/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cfa-64d4-402e-9ce3-4b7c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:14.000Z",
|
|
"modified": "2017-02-07T06:45:14.000Z",
|
|
"description": "payload - Xchecked via VT: d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122",
|
|
"pattern": "[file:hashes.SHA1 = 'a76b850aa336dfb5c83c50e83f24a9c844641684']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cfb-6388-411b-a740-41a302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:15.000Z",
|
|
"modified": "2017-02-07T06:45:15.000Z",
|
|
"description": "payload - Xchecked via VT: d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122",
|
|
"pattern": "[file:hashes.MD5 = '9da66a7cf195036cb90606ef106e2234']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58996cfc-d058-4024-a0de-47cb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:16.000Z",
|
|
"modified": "2017-02-07T06:45:16.000Z",
|
|
"first_observed": "2017-02-07T06:45:16Z",
|
|
"last_observed": "2017-02-07T06:45:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58996cfc-d058-4024-a0de-47cb02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58996cfc-d058-4024-a0de-47cb02de0b81",
|
|
"value": "https://www.virustotal.com/file/d214c89af1929af1171ac40999b14a4f6fbcfd13b88cade392853a2c61057122/analysis/1486116167/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cfc-e528-414d-b766-44ec02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:16.000Z",
|
|
"modified": "2017-02-07T06:45:16.000Z",
|
|
"description": "skbmt_faxreport34.pub - Xchecked via VT: 36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed",
|
|
"pattern": "[file:hashes.SHA1 = '9eb47a9bd943afe83c8bbc29669702dfa6db8e18']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cfd-1d94-41fd-9cca-41e102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:17.000Z",
|
|
"modified": "2017-02-07T06:45:17.000Z",
|
|
"description": "skbmt_faxreport34.pub - Xchecked via VT: 36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed",
|
|
"pattern": "[file:hashes.MD5 = '05b8b570dcc6c78f26ede9f6f650097e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58996cfe-2598-4470-b1cf-4c8702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:18.000Z",
|
|
"modified": "2017-02-07T06:45:18.000Z",
|
|
"first_observed": "2017-02-07T06:45:18Z",
|
|
"last_observed": "2017-02-07T06:45:18Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58996cfe-2598-4470-b1cf-4c8702de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58996cfe-2598-4470-b1cf-4c8702de0b81",
|
|
"value": "https://www.virustotal.com/file/36baccd2a4fc4f683c839283123a75de61b01ce93205f4a34975263e9c66aaed/analysis/1486424559/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996cff-b21c-4734-8788-41d702de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:19.000Z",
|
|
"modified": "2017-02-07T06:45:19.000Z",
|
|
"description": "skbmt_fax45.pub - Xchecked via VT: 3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29",
|
|
"pattern": "[file:hashes.SHA1 = '73a9c0054b193703960828808249a77840311bdf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--58996d00-f794-49a3-98ac-481c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:20.000Z",
|
|
"modified": "2017-02-07T06:45:20.000Z",
|
|
"description": "skbmt_fax45.pub - Xchecked via VT: 3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29",
|
|
"pattern": "[file:hashes.MD5 = '6208d08cfb09bae085f2eaeb53c17707']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-02-07T06:45:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--58996d00-630c-4917-a08e-4b8e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-02-07T06:45:20.000Z",
|
|
"modified": "2017-02-07T06:45:20.000Z",
|
|
"first_observed": "2017-02-07T06:45:20Z",
|
|
"last_observed": "2017-02-07T06:45:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--58996d00-630c-4917-a08e-4b8e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--58996d00-630c-4917-a08e-4b8e02de0b81",
|
|
"value": "https://www.virustotal.com/file/3cfd8919f095e048e0f24a41c2f132328f0d0efe19581b308d9d2d3ffad40c29/analysis/1486365572/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |