3267 lines
No EOL
142 KiB
JSON
3267 lines
No EOL
142 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5916cc1f-cb18-4db1-b4f4-a535950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-14T14:41:25.000Z",
|
|
"modified": "2017-05-14T14:41:25.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5916cc1f-cb18-4db1-b4f4-a535950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-14T14:41:25.000Z",
|
|
"modified": "2017-05-14T14:41:25.000Z",
|
|
"name": "OSINT - Player 3 Has Entered the Game: Say Hello to 'WannaCry'",
|
|
"published": "2017-05-14T14:41:42Z",
|
|
"object_refs": [
|
|
"observed-data--5916cc2b-def0-48f4-9e9f-4506950d210f",
|
|
"url--5916cc2b-def0-48f4-9e9f-4506950d210f",
|
|
"x-misp-attribute--5916cc3f-e098-4ef2-80ca-a4d2950d210f",
|
|
"indicator--5916cc5a-5748-4946-b8c4-a4d2950d210f",
|
|
"indicator--5916cc5a-4508-42f2-8724-a4d2950d210f",
|
|
"indicator--5916cc5b-6064-4a69-b6d8-a4d2950d210f",
|
|
"indicator--5916cc5b-f28c-4957-bce1-a4d2950d210f",
|
|
"indicator--5916cc5c-2ea8-4e2d-b522-a4d2950d210f",
|
|
"indicator--5916cc5c-4894-41c7-9b16-a4d2950d210f",
|
|
"indicator--5916cc5c-cb78-42eb-aa56-a4d2950d210f",
|
|
"indicator--5916cc5d-2f8c-4c02-9408-a4d2950d210f",
|
|
"indicator--5916cc5d-44d8-4d86-b9bb-a4d2950d210f",
|
|
"indicator--5916cc5e-4664-44b4-bcf8-a4d2950d210f",
|
|
"indicator--5916cc5e-fd64-4076-ae19-a4d2950d210f",
|
|
"indicator--5916cc5e-b8e8-41eb-8428-a4d2950d210f",
|
|
"indicator--5916cc5f-784c-411a-aad7-a4d2950d210f",
|
|
"indicator--5916cc5f-cd90-456d-b427-a4d2950d210f",
|
|
"indicator--5916cc60-9f54-4445-af99-a4d2950d210f",
|
|
"indicator--5916cc60-2a1c-43e6-a691-a4d2950d210f",
|
|
"indicator--5916cc60-0f7c-4db7-b8ac-a4d2950d210f",
|
|
"indicator--5916cc61-1388-4f07-8798-a4d2950d210f",
|
|
"indicator--5916cc61-52c4-4e5e-a206-a4d2950d210f",
|
|
"indicator--5916cc62-fd24-4762-969a-a4d2950d210f",
|
|
"indicator--5916cc7a-9f6c-462a-9739-7ff6950d210f",
|
|
"indicator--5916cc7b-2f04-48d1-8ff2-7ff6950d210f",
|
|
"indicator--5916cc7c-3eb8-4215-9daa-7ff6950d210f",
|
|
"indicator--5916cc7c-274c-476e-a674-7ff6950d210f",
|
|
"indicator--5916cc7d-0eec-4dd0-bb4e-7ff6950d210f",
|
|
"indicator--5916cc7e-ca28-412c-9220-7ff6950d210f",
|
|
"indicator--5916cc7f-af60-4262-bdd9-7ff6950d210f",
|
|
"indicator--5916cc7f-dfc4-429f-bb3b-7ff6950d210f",
|
|
"indicator--5916cc7f-ef54-41a5-a950-7ff6950d210f",
|
|
"indicator--5916cc80-49a0-4873-81e2-7ff6950d210f",
|
|
"indicator--5916cc80-52a0-44e0-b8df-7ff6950d210f",
|
|
"indicator--5916cc81-4488-4f8c-b7f5-7ff6950d210f",
|
|
"indicator--5916cc81-8998-4fe6-8b12-7ff6950d210f",
|
|
"indicator--5916cc81-7734-4044-86ce-7ff6950d210f",
|
|
"indicator--5916ccbe-11b8-40b6-ab00-8048950d210f",
|
|
"indicator--5916ccbe-da08-4d0e-b7f1-8048950d210f",
|
|
"indicator--5916ccbf-d7fc-4c1b-9837-8048950d210f",
|
|
"indicator--5916ccbf-7e60-4ee1-b03a-8048950d210f",
|
|
"indicator--5916ccc0-20d4-4797-8248-8048950d210f",
|
|
"indicator--5916ccc0-4e44-4bc3-b157-8048950d210f",
|
|
"indicator--5916ccc0-00e8-4ffe-b03a-8048950d210f",
|
|
"indicator--5916ccc1-37b8-4fde-9773-8048950d210f",
|
|
"indicator--5916cd43-70e0-4cdf-8f33-5adf02de0b81",
|
|
"indicator--5916cd43-643c-41f1-b9e8-5adf02de0b81",
|
|
"observed-data--5916cd44-6f68-4e1e-8096-5adf02de0b81",
|
|
"url--5916cd44-6f68-4e1e-8096-5adf02de0b81",
|
|
"indicator--5916cd44-1510-41cb-9f4a-5adf02de0b81",
|
|
"indicator--5916cd45-bd30-4746-8d10-5adf02de0b81",
|
|
"observed-data--5916cd45-1188-490c-b5ab-5adf02de0b81",
|
|
"url--5916cd45-1188-490c-b5ab-5adf02de0b81",
|
|
"indicator--5916cd45-050c-4c52-8d3c-5adf02de0b81",
|
|
"indicator--5916cd46-1fcc-45b0-850a-5adf02de0b81",
|
|
"observed-data--5916cd46-e620-4806-9c19-5adf02de0b81",
|
|
"url--5916cd46-e620-4806-9c19-5adf02de0b81",
|
|
"indicator--5916cd47-5298-441e-8e13-5adf02de0b81",
|
|
"indicator--5916cd47-3178-452a-b656-5adf02de0b81",
|
|
"observed-data--5916cd48-06b8-4312-85a6-5adf02de0b81",
|
|
"url--5916cd48-06b8-4312-85a6-5adf02de0b81",
|
|
"indicator--5916cd48-c2ec-4039-bf79-5adf02de0b81",
|
|
"indicator--5916cd48-777c-49fa-ba36-5adf02de0b81",
|
|
"observed-data--5916cd49-dd64-43aa-96f5-5adf02de0b81",
|
|
"url--5916cd49-dd64-43aa-96f5-5adf02de0b81",
|
|
"indicator--5916cd49-3378-4300-beb2-5adf02de0b81",
|
|
"indicator--5916cd4a-902c-4bf4-bdd5-5adf02de0b81",
|
|
"observed-data--5916cd4a-19ac-4544-9ff5-5adf02de0b81",
|
|
"url--5916cd4a-19ac-4544-9ff5-5adf02de0b81",
|
|
"indicator--5916cd4a-a508-45e6-8545-5adf02de0b81",
|
|
"indicator--5916cd4b-fa4c-4e4f-9776-5adf02de0b81",
|
|
"observed-data--5916cd4b-60dc-45a8-8630-5adf02de0b81",
|
|
"url--5916cd4b-60dc-45a8-8630-5adf02de0b81",
|
|
"indicator--5916cd4c-0a08-4c33-b81b-5adf02de0b81",
|
|
"indicator--5916cd4c-f1ec-4973-8f86-5adf02de0b81",
|
|
"observed-data--5916cd4c-c960-443a-a319-5adf02de0b81",
|
|
"url--5916cd4c-c960-443a-a319-5adf02de0b81",
|
|
"indicator--5916cd4d-3c54-4cf8-8a05-5adf02de0b81",
|
|
"indicator--5916cd4d-5ec4-4427-9af4-5adf02de0b81",
|
|
"observed-data--5916cd4e-0874-43e7-9ded-5adf02de0b81",
|
|
"url--5916cd4e-0874-43e7-9ded-5adf02de0b81",
|
|
"indicator--5916cd4e-8e18-49ae-8bf5-5adf02de0b81",
|
|
"indicator--5916cd4e-5108-4f91-ab77-5adf02de0b81",
|
|
"observed-data--5916cd4f-9990-4f91-921a-5adf02de0b81",
|
|
"url--5916cd4f-9990-4f91-921a-5adf02de0b81",
|
|
"indicator--5916cd4f-062c-4f84-8359-5adf02de0b81",
|
|
"indicator--5916cd50-53e0-42f4-a9d7-5adf02de0b81",
|
|
"observed-data--5916cd50-fbf8-4e05-9787-5adf02de0b81",
|
|
"url--5916cd50-fbf8-4e05-9787-5adf02de0b81",
|
|
"indicator--5916cd51-18a8-4dc0-b550-5adf02de0b81",
|
|
"indicator--5916cd51-f3bc-4061-a18f-5adf02de0b81",
|
|
"observed-data--5916cd51-d3b0-4f06-a806-5adf02de0b81",
|
|
"url--5916cd51-d3b0-4f06-a806-5adf02de0b81",
|
|
"indicator--5916cd52-fe3c-4547-8cc8-5adf02de0b81",
|
|
"indicator--5916cd52-5fe0-461b-be45-5adf02de0b81",
|
|
"observed-data--5916cd53-80b8-429f-8a7b-5adf02de0b81",
|
|
"url--5916cd53-80b8-429f-8a7b-5adf02de0b81",
|
|
"indicator--5916cd53-d870-4dc2-8b70-5adf02de0b81",
|
|
"indicator--5916cd53-455c-47fc-a0e2-5adf02de0b81",
|
|
"observed-data--5916cd54-57d0-41dc-93e2-5adf02de0b81",
|
|
"url--5916cd54-57d0-41dc-93e2-5adf02de0b81",
|
|
"indicator--5916cd54-c280-4b8a-8796-5adf02de0b81",
|
|
"indicator--5916cd55-e140-4d29-baa4-5adf02de0b81",
|
|
"observed-data--5916cd55-5f44-435f-817a-5adf02de0b81",
|
|
"url--5916cd55-5f44-435f-817a-5adf02de0b81",
|
|
"indicator--5916cd56-bb18-452d-85e2-5adf02de0b81",
|
|
"indicator--5916cd56-8c10-41d0-b8fd-5adf02de0b81",
|
|
"observed-data--5916cd56-7720-48cd-bb15-5adf02de0b81",
|
|
"url--5916cd56-7720-48cd-bb15-5adf02de0b81",
|
|
"indicator--5916cd57-e5c4-4c14-9c4b-5adf02de0b81",
|
|
"indicator--5916cd57-63fc-45d8-b2bb-5adf02de0b81",
|
|
"observed-data--5916cd58-c3d8-4e3f-8a81-5adf02de0b81",
|
|
"url--5916cd58-c3d8-4e3f-8a81-5adf02de0b81",
|
|
"indicator--5916cd58-72a0-49a6-b512-5adf02de0b81",
|
|
"indicator--5916cd59-6c40-4252-a554-5adf02de0b81",
|
|
"observed-data--5916cd59-40b4-4123-8dbf-5adf02de0b81",
|
|
"url--5916cd59-40b4-4123-8dbf-5adf02de0b81",
|
|
"indicator--5916cd59-4a78-4502-96d9-5adf02de0b81",
|
|
"indicator--5916cd5a-dbf8-4fc5-891e-5adf02de0b81",
|
|
"observed-data--5916cd5a-802c-48b4-8819-5adf02de0b81",
|
|
"url--5916cd5a-802c-48b4-8819-5adf02de0b81",
|
|
"indicator--5916cd5b-5c80-4a00-8fd8-5adf02de0b81",
|
|
"indicator--5916cd5b-04a8-4a23-8be6-5adf02de0b81",
|
|
"observed-data--5916cd5b-1544-48c5-81fc-5adf02de0b81",
|
|
"url--5916cd5b-1544-48c5-81fc-5adf02de0b81",
|
|
"indicator--5916cd5c-d0a8-4a76-b095-5adf02de0b81",
|
|
"indicator--5916cd5c-197c-4225-9471-5adf02de0b81",
|
|
"observed-data--5916cd5d-9004-4527-b0dc-5adf02de0b81",
|
|
"url--5916cd5d-9004-4527-b0dc-5adf02de0b81",
|
|
"indicator--5916cd5d-479c-43bd-9ba0-5adf02de0b81",
|
|
"indicator--5916cd5e-7a38-4469-9616-5adf02de0b81",
|
|
"observed-data--5916cd5e-456c-4b7a-8059-5adf02de0b81",
|
|
"url--5916cd5e-456c-4b7a-8059-5adf02de0b81",
|
|
"indicator--5916cd5e-21cc-4102-b78f-5adf02de0b81",
|
|
"indicator--5916cd5f-e7f0-47c9-ac2b-5adf02de0b81",
|
|
"observed-data--5916cd5f-9e94-4bbc-8e6f-5adf02de0b81",
|
|
"url--5916cd5f-9e94-4bbc-8e6f-5adf02de0b81",
|
|
"indicator--5916cd60-0b58-4ce7-a622-5adf02de0b81",
|
|
"indicator--5916cd60-70cc-400c-82a9-5adf02de0b81",
|
|
"observed-data--5916cd61-8028-41c8-a722-5adf02de0b81",
|
|
"url--5916cd61-8028-41c8-a722-5adf02de0b81",
|
|
"indicator--5916cd61-37e8-4fba-975f-5adf02de0b81",
|
|
"indicator--5916cd61-e258-4616-bca3-5adf02de0b81",
|
|
"observed-data--5916cd62-5838-47f7-aebe-5adf02de0b81",
|
|
"url--5916cd62-5838-47f7-aebe-5adf02de0b81",
|
|
"indicator--5916cd62-db48-47fe-85e9-5adf02de0b81",
|
|
"indicator--5916cd63-ef30-4f05-85bf-5adf02de0b81",
|
|
"observed-data--5916cd63-91e4-4acf-9271-5adf02de0b81",
|
|
"url--5916cd63-91e4-4acf-9271-5adf02de0b81",
|
|
"indicator--5916cd63-ae14-4474-ae96-5adf02de0b81",
|
|
"indicator--5916cd64-0098-4529-8f32-5adf02de0b81",
|
|
"observed-data--5916cd64-3840-4664-8c47-5adf02de0b81",
|
|
"url--5916cd64-3840-4664-8c47-5adf02de0b81",
|
|
"indicator--5916cd65-8700-4e03-983a-5adf02de0b81",
|
|
"indicator--5916cd65-a6cc-428a-8ac5-5adf02de0b81",
|
|
"observed-data--5916cd65-57a8-4b88-a313-5adf02de0b81",
|
|
"url--5916cd65-57a8-4b88-a313-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"misp-galaxy:ransomware=\"WannaCry\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cc2b-def0-48f4-9e9f-4506950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"first_observed": "2017-05-13T09:09:03Z",
|
|
"last_observed": "2017-05-13T09:09:03Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cc2b-def0-48f4-9e9f-4506950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cc2b-def0-48f4-9e9f-4506950d210f",
|
|
"value": "http://blog.talosintelligence.com/2017/05/wannacry.html"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5916cc3f-e098-4ef2-80ca-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "A major ransomware attack has affected many organizations across the world reportedly including Telefonica in Spain, the National Health Service in the UK, and FedEx in the US. The malware responsible for this attack is a ransomware variant known as 'WannaCry'.\r\n\r\nThe malware then has the capability to scan heavily over TCP port 445 (Server Message Block/SMB), spreading similar to a worm, compromising hosts, encrypting files stored on them then demanding a ransom payment in the form of Bitcoin.\r\n\r\nAdditionally, Talos has observed WannaCry samples making use of DOUBLEPULSAR which is a persistent backdoor that is generally used to access and execute code on previously compromised systems. This allows for the installation and activation of additional software, such as malware. This backdoor is typically installed following successful exploitation of SMB vulnerabilities addressed as part of Microsoft Security Bulletin MS17-010. This backdoor is associated with an offensive exploitation framework that was released as part of the Shadow Brokers cache that was recently released to the public. Since its release it has been widely analyzed and studied by the security industry as well as on various underground hacking forums.\r\n\r\nWannaCry does not appear to be only be leveraging the ETERNALBLUE modules associated with this attack framework, it is simply scanning accessible servers for the presence of the DOUBLEPULSAR backdoor. In cases where it identifies a host that has been implanted with this backdoor, it simply leverages the existing backdoor functionality available and uses it to infect the system with WannaCry. In cases where the system has not been previously compromised and implanted with DOUBLEPULSAR, the malware will use ETERNALBLUE for the initial exploitation of the SMB vulnerability. This is the cause of the worm-like activity that has been widely observed across the internet.\r\n\r\nOrganizations should ensure that devices running Windows are fully patched and deployed in accordance with best practices. Additionally, organizations should have SMB ports (139, 445) blocked from all externally accessible hosts.\r\n\r\nPlease note this threat is still under active investigation, the situation may change as we learn more or as our adversary responds to our actions. Talos will continue to actively monitor and analyze this situation for new developments and respond accordingly. As a result, new coverage may be developed or existing coverage adapted and/or modified at a later date. For current information, please refer to your Firepower Management Center or Snort.org."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5a-5748-4946-b8c4-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5a-4508-42f2-8724-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5b-6064-4a69-b6d8-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5b-f28c-4957-bce1-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5c-2ea8-4e2d-b522-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5c-4894-41c7-9b16-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '5c1f4f69c45cff9725d9969f9ffcf79d07bd0f624e06cfa5bcbacd2211046ed6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5c-cb78-42eb-aa56-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '62d828ee000e44f670ba322644c2351fe31af5b88a98f2b2ce27e423dcf1d1b1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5d-2f8c-4c02-9408-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '72af12d8139a80f317e851a60027fdf208871ed334c12637f49d819ab4b033dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5d-44d8-4d86-b9bb-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '85ce324b8f78021ecfc9b811c748f19b82e61bb093ff64f2eab457f9ef19b186']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5e-4664-44b4-bcf8-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5e-fd64-4076-ae19-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'a93ee7ea13238bd038bcbec635f39619db566145498fe6e0ea60e6e76d614bd3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5e-b8e8-41eb-8428-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5f-784c-411a-aad7-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'eb47cd6a937221411bb8daf35900a9897fb234160087089a064066a65f42bcd4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc5f-cd90-456d-b427-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc60-9f54-4445-af99-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '2c2d8bc91564050cf073745f1b117f4ffdd6470e87166abdfcd10ecdff040a2e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc60-2a1c-43e6-a691-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '7a828afd2abf153d840938090d498072b7e507c7021e4cdd8c6baf727cafc545']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc60-0f7c-4db7-b8ac-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'a897345b68191fd36f8cefb52e6a77acb2367432abb648b9ae0a9d708406de5b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc61-1388-4f07-8798-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = 'fb0b6044347e972e21b6c376e37e1115dab494a2c6b9fb28b92b1e45b45d0ebc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc61-52c4-4e5e-a206-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '9588f2ef06b7e1c8509f32d8eddfa18041a9cc15b1c90d6da484a39f8dcdf967']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc62-fd24-4762-969a-a4d2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "Observed hash values",
|
|
"pattern": "[file:hashes.SHA256 = '4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7a-9f6c-462a-9739-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.166.23.127' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7b-2f04-48d1-8ff2-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '193.23.244.244' AND network-traffic:dst_port = '443']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7c-3eb8-4215-9daa-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '2.3.69.209' AND network-traffic:dst_port = '9001']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7c-274c-476e-a674-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '146.0.32.144' AND network-traffic:dst_port = '9001']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7d-0eec-4dd0-bb4e-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.7.161.218' AND network-traffic:dst_port = '9001']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst|port\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7e-ca28-412c-9220-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.79.179.77']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7f-af60-4262-bdd9-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '128.31.0.39']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7f-dfc4-429f-bb3b-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '213.61.66.116']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc7f-ef54-41a5-a950-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '212.47.232.237']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc80-49a0-4873-81e2-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '81.30.158.223']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc80-52a0-44e0-b8df-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '79.172.193.32']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc81-4488-4f8c-b7f5-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '89.45.235.21']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc81-8998-4fe6-8b12-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '38.229.72.16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cc81-7734-4044-86ce-7ff6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "CnC IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '188.138.33.220']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccbe-11b8-40b6-ab00-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "b.wnry",
|
|
"pattern": "[file:hashes.SHA256 = 'd5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccbe-da08-4d0e-b7f1-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "c.wnry",
|
|
"pattern": "[file:hashes.SHA256 = '055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccbf-d7fc-4c1b-9837-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "r.wnry",
|
|
"pattern": "[file:hashes.SHA256 = '402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccbf-7e60-4ee1-b03a-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "s.wnry",
|
|
"pattern": "[file:hashes.SHA256 = 'e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccc0-20d4-4797-8248-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "taskdl.exe",
|
|
"pattern": "[file:hashes.SHA256 = '4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccc0-4e44-4bc3-b157-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "taskse.exe",
|
|
"pattern": "[file:hashes.SHA256 = '2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccc0-00e8-4ffe-b03a-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "t.wnry",
|
|
"pattern": "[file:hashes.SHA256 = '97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916ccc1-37b8-4fde-9773-8048950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:03.000Z",
|
|
"modified": "2017-05-13T09:09:03.000Z",
|
|
"description": "u.wnry",
|
|
"pattern": "[file:hashes.SHA256 = 'b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd43-70e0-4cdf-8f33-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:23.000Z",
|
|
"modified": "2017-05-13T09:09:23.000Z",
|
|
"description": "u.wnry - Xchecked via VT: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25",
|
|
"pattern": "[file:hashes.SHA1 = '45356a9dd616ed7161a3b9192e2f318d0ab5ad10']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd43-643c-41f1-b9e8-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:23.000Z",
|
|
"modified": "2017-05-13T09:09:23.000Z",
|
|
"description": "u.wnry - Xchecked via VT: b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25",
|
|
"pattern": "[file:hashes.MD5 = '7bf2b57f2a205768755c07f238fb32cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd44-6f68-4e1e-8096-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:24.000Z",
|
|
"modified": "2017-05-13T09:09:24.000Z",
|
|
"first_observed": "2017-05-13T09:09:24Z",
|
|
"last_observed": "2017-05-13T09:09:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd44-6f68-4e1e-8096-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd44-6f68-4e1e-8096-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25/analysis/1494665306/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd44-1510-41cb-9f4a-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:24.000Z",
|
|
"modified": "2017-05-13T09:09:24.000Z",
|
|
"description": "t.wnry - Xchecked via VT: 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6",
|
|
"pattern": "[file:hashes.SHA1 = '7b10aaeee05e7a1efb43d9f837e9356ad55c07dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd45-bd30-4746-8d10-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:25.000Z",
|
|
"modified": "2017-05-13T09:09:25.000Z",
|
|
"description": "t.wnry - Xchecked via VT: 97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6",
|
|
"pattern": "[file:hashes.MD5 = '5dcaac857e695a65f5c3ef1441a73a8f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd45-1188-490c-b5ab-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:25.000Z",
|
|
"modified": "2017-05-13T09:09:25.000Z",
|
|
"first_observed": "2017-05-13T09:09:25Z",
|
|
"last_observed": "2017-05-13T09:09:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd45-1188-490c-b5ab-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd45-1188-490c-b5ab-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/97ebce49b14c46bebc9ec2448d00e1e397123b256e2be9eba5140688e7bc0ae6/analysis/1494661291/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd45-050c-4c52-8d3c-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:25.000Z",
|
|
"modified": "2017-05-13T09:09:25.000Z",
|
|
"description": "taskse.exe - Xchecked via VT: 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d",
|
|
"pattern": "[file:hashes.SHA1 = 'be5d6279874da315e3080b06083757aad9b32c23']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd46-1fcc-45b0-850a-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:26.000Z",
|
|
"modified": "2017-05-13T09:09:26.000Z",
|
|
"description": "taskse.exe - Xchecked via VT: 2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d",
|
|
"pattern": "[file:hashes.MD5 = '8495400f199ac77853c53b5a3f278f3e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd46-e620-4806-9c19-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:26.000Z",
|
|
"modified": "2017-05-13T09:09:26.000Z",
|
|
"first_observed": "2017-05-13T09:09:26Z",
|
|
"last_observed": "2017-05-13T09:09:26Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd46-e620-4806-9c19-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd46-e620-4806-9c19-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/2ca2d550e603d74dedda03156023135b38da3630cb014e3d00b1263358c5f00d/analysis/1494664558/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd47-5298-441e-8e13-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:27.000Z",
|
|
"modified": "2017-05-13T09:09:27.000Z",
|
|
"description": "taskdl.exe - Xchecked via VT: 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79",
|
|
"pattern": "[file:hashes.SHA1 = '47a9ad4125b6bd7c55e4e7da251e23f089407b8f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd47-3178-452a-b656-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:27.000Z",
|
|
"modified": "2017-05-13T09:09:27.000Z",
|
|
"description": "taskdl.exe - Xchecked via VT: 4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79",
|
|
"pattern": "[file:hashes.MD5 = '4fef5e34143e646dbf9907c4374276f5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd48-06b8-4312-85a6-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:28.000Z",
|
|
"modified": "2017-05-13T09:09:28.000Z",
|
|
"first_observed": "2017-05-13T09:09:28Z",
|
|
"last_observed": "2017-05-13T09:09:28Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd48-06b8-4312-85a6-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd48-06b8-4312-85a6-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/4a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79/analysis/1494664721/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd48-c2ec-4039-bf79-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:28.000Z",
|
|
"modified": "2017-05-13T09:09:28.000Z",
|
|
"description": "s.wnry - Xchecked via VT: e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b",
|
|
"pattern": "[file:hashes.SHA1 = 'd1af27518d455d432b62d73c6a1497d032f6120e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd48-777c-49fa-ba36-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:28.000Z",
|
|
"modified": "2017-05-13T09:09:28.000Z",
|
|
"description": "s.wnry - Xchecked via VT: e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b",
|
|
"pattern": "[file:hashes.MD5 = 'ad4c9de7c8c40813f200ba1c2fa33083']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd49-dd64-43aa-96f5-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:29.000Z",
|
|
"modified": "2017-05-13T09:09:29.000Z",
|
|
"first_observed": "2017-05-13T09:09:29Z",
|
|
"last_observed": "2017-05-13T09:09:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd49-dd64-43aa-96f5-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd49-dd64-43aa-96f5-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/e18fdd912dfe5b45776e68d578c3af3547886cf1353d7086c8bee037436dff4b/analysis/1494665700/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd49-3378-4300-beb2-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:29.000Z",
|
|
"modified": "2017-05-13T09:09:29.000Z",
|
|
"description": "r.wnry - Xchecked via VT: 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c",
|
|
"pattern": "[file:hashes.SHA1 = 'c3a91c22b63f6fe709e7c29cafb29a2ee83e6ade']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4a-902c-4bf4-bdd5-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:30.000Z",
|
|
"modified": "2017-05-13T09:09:30.000Z",
|
|
"description": "r.wnry - Xchecked via VT: 402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c",
|
|
"pattern": "[file:hashes.MD5 = '3e0020fc529b1c2a061016dd2469ba96']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd4a-19ac-4544-9ff5-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:30.000Z",
|
|
"modified": "2017-05-13T09:09:30.000Z",
|
|
"first_observed": "2017-05-13T09:09:30Z",
|
|
"last_observed": "2017-05-13T09:09:30Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd4a-19ac-4544-9ff5-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd4a-19ac-4544-9ff5-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/402751fa49e0cb68fe052cb3db87b05e71c1d950984d339940cf6b29409f2a7c/analysis/1494622860/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4a-a508-45e6-8545-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:30.000Z",
|
|
"modified": "2017-05-13T09:09:30.000Z",
|
|
"description": "c.wnry - Xchecked via VT: 055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622",
|
|
"pattern": "[file:hashes.SHA1 = 'f6b08523b1a836e2112875398ffefffde98ad3ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4b-fa4c-4e4f-9776-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:31.000Z",
|
|
"modified": "2017-05-13T09:09:31.000Z",
|
|
"description": "c.wnry - Xchecked via VT: 055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622",
|
|
"pattern": "[file:hashes.MD5 = 'ae08f79a0d800b82fcbe1b43cdbdbefc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd4b-60dc-45a8-8630-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:31.000Z",
|
|
"modified": "2017-05-13T09:09:31.000Z",
|
|
"first_observed": "2017-05-13T09:09:31Z",
|
|
"last_observed": "2017-05-13T09:09:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd4b-60dc-45a8-8630-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd4b-60dc-45a8-8630-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/055c7760512c98c8d51e4427227fe2a7ea3b34ee63178fe78631fa8aa6d15622/analysis/1494617269/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4c-0a08-4c33-b81b-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:32.000Z",
|
|
"modified": "2017-05-13T09:09:32.000Z",
|
|
"description": "b.wnry - Xchecked via VT: d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa",
|
|
"pattern": "[file:hashes.SHA1 = 'f19eceda82973239a1fdc5826bce7691e5dcb4fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4c-f1ec-4973-8f86-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:32.000Z",
|
|
"modified": "2017-05-13T09:09:32.000Z",
|
|
"description": "b.wnry - Xchecked via VT: d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa",
|
|
"pattern": "[file:hashes.MD5 = 'c17170262312f3be7027bc2ca825bf0c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd4c-c960-443a-a319-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:32.000Z",
|
|
"modified": "2017-05-13T09:09:32.000Z",
|
|
"first_observed": "2017-05-13T09:09:32Z",
|
|
"last_observed": "2017-05-13T09:09:32Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd4c-c960-443a-a319-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd4c-c960-443a-a319-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa/analysis/1494622620/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4d-3c54-4cf8-8a05-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:33.000Z",
|
|
"modified": "2017-05-13T09:09:33.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982",
|
|
"pattern": "[file:hashes.SHA1 = '50049556b3406e07347411767d6d01a704b6fee6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4d-5ec4-4427-9af4-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:33.000Z",
|
|
"modified": "2017-05-13T09:09:33.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982",
|
|
"pattern": "[file:hashes.MD5 = '5bef35496fcbdbe841c82f4d1ab8b7c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd4e-0874-43e7-9ded-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:34.000Z",
|
|
"modified": "2017-05-13T09:09:34.000Z",
|
|
"first_observed": "2017-05-13T09:09:34Z",
|
|
"last_observed": "2017-05-13T09:09:34Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd4e-0874-43e7-9ded-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd4e-0874-43e7-9ded-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/4186675cb6706f9d51167fb0f14cd3f8fcfb0065093f62b10a15f7d9a6c8d982/analysis/1494652583/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4e-8e18-49ae-8bf5-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:34.000Z",
|
|
"modified": "2017-05-13T09:09:34.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 9588f2ef06b7e1c8509f32d8eddfa18041a9cc15b1c90d6da484a39f8dcdf967",
|
|
"pattern": "[file:hashes.SHA1 = '279c7fff07db69562b8f98a0503480cc84ca5c3b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4e-5108-4f91-ab77-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:34.000Z",
|
|
"modified": "2017-05-13T09:09:34.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 9588f2ef06b7e1c8509f32d8eddfa18041a9cc15b1c90d6da484a39f8dcdf967",
|
|
"pattern": "[file:hashes.MD5 = '09431f379fc1914685f93f56c2400133']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd4f-9990-4f91-921a-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:35.000Z",
|
|
"modified": "2017-05-13T09:09:35.000Z",
|
|
"first_observed": "2017-05-13T09:09:35Z",
|
|
"last_observed": "2017-05-13T09:09:35Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd4f-9990-4f91-921a-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd4f-9990-4f91-921a-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/9588f2ef06b7e1c8509f32d8eddfa18041a9cc15b1c90d6da484a39f8dcdf967/analysis/1494594198/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd4f-062c-4f84-8359-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:35.000Z",
|
|
"modified": "2017-05-13T09:09:35.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: fb0b6044347e972e21b6c376e37e1115dab494a2c6b9fb28b92b1e45b45d0ebc",
|
|
"pattern": "[file:hashes.SHA1 = '4dbd35dda6f41aeb94fe26291209555a878007c4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd50-53e0-42f4-a9d7-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:36.000Z",
|
|
"modified": "2017-05-13T09:09:36.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: fb0b6044347e972e21b6c376e37e1115dab494a2c6b9fb28b92b1e45b45d0ebc",
|
|
"pattern": "[file:hashes.MD5 = '92288b762108968a36537b06027e286b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd50-fbf8-4e05-9787-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:36.000Z",
|
|
"modified": "2017-05-13T09:09:36.000Z",
|
|
"first_observed": "2017-05-13T09:09:36Z",
|
|
"last_observed": "2017-05-13T09:09:36Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd50-fbf8-4e05-9787-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd50-fbf8-4e05-9787-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/fb0b6044347e972e21b6c376e37e1115dab494a2c6b9fb28b92b1e45b45d0ebc/analysis/1494599124/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd51-18a8-4dc0-b550-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:37.000Z",
|
|
"modified": "2017-05-13T09:09:37.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a897345b68191fd36f8cefb52e6a77acb2367432abb648b9ae0a9d708406de5b",
|
|
"pattern": "[file:hashes.SHA1 = '8e4f557eb0fe80217d7a9f8cc4ebabfd9a14eb70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd51-f3bc-4061-a18f-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:37.000Z",
|
|
"modified": "2017-05-13T09:09:37.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a897345b68191fd36f8cefb52e6a77acb2367432abb648b9ae0a9d708406de5b",
|
|
"pattern": "[file:hashes.MD5 = '83e5a812a371e0790066c6fb038f0d26']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd51-d3b0-4f06-a806-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:37.000Z",
|
|
"modified": "2017-05-13T09:09:37.000Z",
|
|
"first_observed": "2017-05-13T09:09:37Z",
|
|
"last_observed": "2017-05-13T09:09:37Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd51-d3b0-4f06-a806-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd51-d3b0-4f06-a806-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/a897345b68191fd36f8cefb52e6a77acb2367432abb648b9ae0a9d708406de5b/analysis/1494614523/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd52-fe3c-4547-8cc8-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:38.000Z",
|
|
"modified": "2017-05-13T09:09:38.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 7a828afd2abf153d840938090d498072b7e507c7021e4cdd8c6baf727cafc545",
|
|
"pattern": "[file:hashes.SHA1 = '3e6b9a61ec9ae5de35fd5a1c58de1d324441e85e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd52-5fe0-461b-be45-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:38.000Z",
|
|
"modified": "2017-05-13T09:09:38.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 7a828afd2abf153d840938090d498072b7e507c7021e4cdd8c6baf727cafc545",
|
|
"pattern": "[file:hashes.MD5 = '26b205ffe4adaadbb442442cae653bdd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd53-80b8-429f-8a7b-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:39.000Z",
|
|
"modified": "2017-05-13T09:09:39.000Z",
|
|
"first_observed": "2017-05-13T09:09:39Z",
|
|
"last_observed": "2017-05-13T09:09:39Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd53-80b8-429f-8a7b-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd53-80b8-429f-8a7b-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/7a828afd2abf153d840938090d498072b7e507c7021e4cdd8c6baf727cafc545/analysis/1494654507/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd53-d870-4dc2-8b70-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:39.000Z",
|
|
"modified": "2017-05-13T09:09:39.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 2c2d8bc91564050cf073745f1b117f4ffdd6470e87166abdfcd10ecdff040a2e",
|
|
"pattern": "[file:hashes.SHA1 = 'eafc1137694fafc5a6256c86252e5bd0603e5313']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd53-455c-47fc-a0e2-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:39.000Z",
|
|
"modified": "2017-05-13T09:09:39.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 2c2d8bc91564050cf073745f1b117f4ffdd6470e87166abdfcd10ecdff040a2e",
|
|
"pattern": "[file:hashes.MD5 = '9f7fc2175a4563422a882fc978c74c5d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd54-57d0-41dc-93e2-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:40.000Z",
|
|
"modified": "2017-05-13T09:09:40.000Z",
|
|
"first_observed": "2017-05-13T09:09:40Z",
|
|
"last_observed": "2017-05-13T09:09:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd54-57d0-41dc-93e2-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd54-57d0-41dc-93e2-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/2c2d8bc91564050cf073745f1b117f4ffdd6470e87166abdfcd10ecdff040a2e/analysis/1494599081/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd54-c280-4b8a-8796-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:40.000Z",
|
|
"modified": "2017-05-13T09:09:40.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c",
|
|
"pattern": "[file:hashes.SHA1 = 'e889544aff85ffaf8b0d0da705105dee7c97fe26']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd55-e140-4d29-baa4-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:41.000Z",
|
|
"modified": "2017-05-13T09:09:41.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c",
|
|
"pattern": "[file:hashes.MD5 = 'db349b97c37d22f5ea1d1841e3c89eb4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd55-5f44-435f-817a-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:41.000Z",
|
|
"modified": "2017-05-13T09:09:41.000Z",
|
|
"first_observed": "2017-05-13T09:09:41Z",
|
|
"last_observed": "2017-05-13T09:09:41Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd55-5f44-435f-817a-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd55-5f44-435f-817a-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/24d004a104d4d54034dbcffc2a4b19a11f39008a575aa614ea04703480b1022c/analysis/1494662861/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd56-bb18-452d-85e2-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:42.000Z",
|
|
"modified": "2017-05-13T09:09:42.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: eb47cd6a937221411bb8daf35900a9897fb234160087089a064066a65f42bcd4",
|
|
"pattern": "[file:hashes.SHA1 = '2e64d406cdd1c16e2c37628c32aeab137d3c5648']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd56-8c10-41d0-b8fd-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:42.000Z",
|
|
"modified": "2017-05-13T09:09:42.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: eb47cd6a937221411bb8daf35900a9897fb234160087089a064066a65f42bcd4",
|
|
"pattern": "[file:hashes.MD5 = '9e3e3633dc0a841b42e0a12977b5056f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd56-7720-48cd-bb15-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:42.000Z",
|
|
"modified": "2017-05-13T09:09:42.000Z",
|
|
"first_observed": "2017-05-13T09:09:42Z",
|
|
"last_observed": "2017-05-13T09:09:42Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd56-7720-48cd-bb15-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd56-7720-48cd-bb15-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/eb47cd6a937221411bb8daf35900a9897fb234160087089a064066a65f42bcd4/analysis/1494586193/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd57-e5c4-4c14-9c4b-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:43.000Z",
|
|
"modified": "2017-05-13T09:09:43.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c",
|
|
"pattern": "[file:hashes.SHA1 = '8da1a75a548d5cb47547a50c04d72f53a355a4bd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd57-63fc-45d8-b2bb-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:43.000Z",
|
|
"modified": "2017-05-13T09:09:43.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c",
|
|
"pattern": "[file:hashes.MD5 = '29365f675b69ffa0ec17ad00649ce026']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd58-c3d8-4e3f-8a81-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:44.000Z",
|
|
"modified": "2017-05-13T09:09:44.000Z",
|
|
"first_observed": "2017-05-13T09:09:44Z",
|
|
"last_observed": "2017-05-13T09:09:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd58-c3d8-4e3f-8a81-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd58-c3d8-4e3f-8a81-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/b43b234012b8233b3df6adb7c0a3b2b13cc2354dd6de27e092873bf58af2693c/analysis/1494612331/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd58-72a0-49a6-b512-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:44.000Z",
|
|
"modified": "2017-05-13T09:09:44.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a93ee7ea13238bd038bcbec635f39619db566145498fe6e0ea60e6e76d614bd3",
|
|
"pattern": "[file:hashes.SHA1 = 'a6d1aef38b0fb8ce07054d777ed1b82e09dbbdd7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd59-6c40-4252-a554-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:45.000Z",
|
|
"modified": "2017-05-13T09:09:45.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a93ee7ea13238bd038bcbec635f39619db566145498fe6e0ea60e6e76d614bd3",
|
|
"pattern": "[file:hashes.MD5 = '17d24b11964554c46092adfaeab7b490']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd59-40b4-4123-8dbf-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:45.000Z",
|
|
"modified": "2017-05-13T09:09:45.000Z",
|
|
"first_observed": "2017-05-13T09:09:45Z",
|
|
"last_observed": "2017-05-13T09:09:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd59-40b4-4123-8dbf-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd59-40b4-4123-8dbf-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/a93ee7ea13238bd038bcbec635f39619db566145498fe6e0ea60e6e76d614bd3/analysis/1494610661/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd59-4a78-4502-96d9-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:45.000Z",
|
|
"modified": "2017-05-13T09:09:45.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b",
|
|
"pattern": "[file:hashes.SHA1 = '1ea0e55dc330806f45e0489a678875693ec4361f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5a-dbf8-4fc5-891e-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:46.000Z",
|
|
"modified": "2017-05-13T09:09:46.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b",
|
|
"pattern": "[file:hashes.MD5 = '58c54e44406b0914d22157dffeb09e44']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd5a-802c-48b4-8819-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:46.000Z",
|
|
"modified": "2017-05-13T09:09:46.000Z",
|
|
"first_observed": "2017-05-13T09:09:46Z",
|
|
"last_observed": "2017-05-13T09:09:46Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd5a-802c-48b4-8819-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd5a-802c-48b4-8819-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/a1d9cd6f189beff28a0a49b10f8fe4510128471f004b3e4283ddc7f78594906b/analysis/1494586139/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5b-5c80-4a00-8fd8-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:47.000Z",
|
|
"modified": "2017-05-13T09:09:47.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 85ce324b8f78021ecfc9b811c748f19b82e61bb093ff64f2eab457f9ef19b186",
|
|
"pattern": "[file:hashes.SHA1 = '18ba455efe2476730346c69cc7e7d6acfa5f074d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5b-04a8-4a23-8be6-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:47.000Z",
|
|
"modified": "2017-05-13T09:09:47.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 85ce324b8f78021ecfc9b811c748f19b82e61bb093ff64f2eab457f9ef19b186",
|
|
"pattern": "[file:hashes.MD5 = '22a42f1a088ca55c14c2abc0169e3e5f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd5b-1544-48c5-81fc-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:47.000Z",
|
|
"modified": "2017-05-13T09:09:47.000Z",
|
|
"first_observed": "2017-05-13T09:09:47Z",
|
|
"last_observed": "2017-05-13T09:09:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd5b-1544-48c5-81fc-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd5b-1544-48c5-81fc-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/85ce324b8f78021ecfc9b811c748f19b82e61bb093ff64f2eab457f9ef19b186/analysis/1494624170/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5c-d0a8-4a76-b095-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:48.000Z",
|
|
"modified": "2017-05-13T09:09:48.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 72af12d8139a80f317e851a60027fdf208871ed334c12637f49d819ab4b033dd",
|
|
"pattern": "[file:hashes.SHA1 = '10532b8992d4ad0a348d12f64081b77db9cdbb24']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5c-197c-4225-9471-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:48.000Z",
|
|
"modified": "2017-05-13T09:09:48.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 72af12d8139a80f317e851a60027fdf208871ed334c12637f49d819ab4b033dd",
|
|
"pattern": "[file:hashes.MD5 = '4d87b4461ba0c37848a08c3ac031bb67']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd5d-9004-4527-b0dc-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:49.000Z",
|
|
"modified": "2017-05-13T09:09:49.000Z",
|
|
"first_observed": "2017-05-13T09:09:49Z",
|
|
"last_observed": "2017-05-13T09:09:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd5d-9004-4527-b0dc-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd5d-9004-4527-b0dc-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/72af12d8139a80f317e851a60027fdf208871ed334c12637f49d819ab4b033dd/analysis/1494586459/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5d-479c-43bd-9ba0-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:49.000Z",
|
|
"modified": "2017-05-13T09:09:49.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 62d828ee000e44f670ba322644c2351fe31af5b88a98f2b2ce27e423dcf1d1b1",
|
|
"pattern": "[file:hashes.SHA1 = '18c2783cbf0a77afb6237aa6a8c5f65ca7d114f9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5e-7a38-4469-9616-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:50.000Z",
|
|
"modified": "2017-05-13T09:09:50.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 62d828ee000e44f670ba322644c2351fe31af5b88a98f2b2ce27e423dcf1d1b1",
|
|
"pattern": "[file:hashes.MD5 = 'ec7aa695e821cd46f4e07d6fbd5e367e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd5e-456c-4b7a-8059-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:50.000Z",
|
|
"modified": "2017-05-13T09:09:50.000Z",
|
|
"first_observed": "2017-05-13T09:09:50Z",
|
|
"last_observed": "2017-05-13T09:09:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd5e-456c-4b7a-8059-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd5e-456c-4b7a-8059-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/62d828ee000e44f670ba322644c2351fe31af5b88a98f2b2ce27e423dcf1d1b1/analysis/1494596619/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5e-21cc-4102-b78f-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:50.000Z",
|
|
"modified": "2017-05-13T09:09:50.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 5c1f4f69c45cff9725d9969f9ffcf79d07bd0f624e06cfa5bcbacd2211046ed6",
|
|
"pattern": "[file:hashes.SHA1 = '0bf890be902f0e00b06c743b78c5e0dc1535b8f8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd5f-e7f0-47c9-ac2b-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:51.000Z",
|
|
"modified": "2017-05-13T09:09:51.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 5c1f4f69c45cff9725d9969f9ffcf79d07bd0f624e06cfa5bcbacd2211046ed6",
|
|
"pattern": "[file:hashes.MD5 = '40d3f292910a8a439c8b2cf01caff758']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd5f-9e94-4bbc-8e6f-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:51.000Z",
|
|
"modified": "2017-05-13T09:09:51.000Z",
|
|
"first_observed": "2017-05-13T09:09:51Z",
|
|
"last_observed": "2017-05-13T09:09:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd5f-9e94-4bbc-8e6f-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd5f-9e94-4bbc-8e6f-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/5c1f4f69c45cff9725d9969f9ffcf79d07bd0f624e06cfa5bcbacd2211046ed6/analysis/1494597544/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd60-0b58-4ce7-a622-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:52.000Z",
|
|
"modified": "2017-05-13T09:09:52.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f",
|
|
"pattern": "[file:hashes.SHA1 = 'eb3e2f6288a8066020a1c1b4ce258e804c55df08']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd60-70cc-400c-82a9-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:52.000Z",
|
|
"modified": "2017-05-13T09:09:52.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f",
|
|
"pattern": "[file:hashes.MD5 = 'f34e53444d665785723ea111942eb1d9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd61-8028-41c8-a722-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:53.000Z",
|
|
"modified": "2017-05-13T09:09:53.000Z",
|
|
"first_observed": "2017-05-13T09:09:53Z",
|
|
"last_observed": "2017-05-13T09:09:53Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd61-8028-41c8-a722-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd61-8028-41c8-a722-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/428f22a9afd2797ede7c0583d34a052c32693cbb55f567a60298587b6e675c6f/analysis/1494598235/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd61-37e8-4fba-975f-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:53.000Z",
|
|
"modified": "2017-05-13T09:09:53.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894",
|
|
"pattern": "[file:hashes.SHA1 = '51569fe4b318cfd40dd0cf88497f7cc651144755']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd61-e258-4616-bca3-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:53.000Z",
|
|
"modified": "2017-05-13T09:09:53.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894",
|
|
"pattern": "[file:hashes.MD5 = 'd5c0caf39de29dc769204d33e76c21fc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd62-5838-47f7-aebe-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:54.000Z",
|
|
"modified": "2017-05-13T09:09:54.000Z",
|
|
"first_observed": "2017-05-13T09:09:54Z",
|
|
"last_observed": "2017-05-13T09:09:54Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd62-5838-47f7-aebe-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd62-5838-47f7-aebe-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/0a73291ab5607aef7db23863cf8e72f55bcb3c273bb47f00edf011515aeb5894/analysis/1494626827/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd62-db48-47fe-85e9-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:54.000Z",
|
|
"modified": "2017-05-13T09:09:54.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa",
|
|
"pattern": "[file:hashes.SHA1 = '87420a2791d18dad3f18be436045280a4cc16fc4']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd63-ef30-4f05-85bf-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:55.000Z",
|
|
"modified": "2017-05-13T09:09:55.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: 09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa",
|
|
"pattern": "[file:hashes.MD5 = '509c41ec97bb81b0567b059aa2f50fe8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd63-91e4-4acf-9271-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:55.000Z",
|
|
"modified": "2017-05-13T09:09:55.000Z",
|
|
"first_observed": "2017-05-13T09:09:55Z",
|
|
"last_observed": "2017-05-13T09:09:55Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd63-91e4-4acf-9271-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd63-91e4-4acf-9271-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/09a46b3e1be080745a6d8d88d6b5bd351b1c7586ae0dc94d0c238ee36421cafa/analysis/1494647902/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd63-ae14-4474-ae96-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:55.000Z",
|
|
"modified": "2017-05-13T09:09:55.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9",
|
|
"pattern": "[file:hashes.SHA1 = '8897c658c0373be54eeac23bbd4264687a141ae1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd64-0098-4529-8f32-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:56.000Z",
|
|
"modified": "2017-05-13T09:09:56.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9",
|
|
"pattern": "[file:hashes.MD5 = '86721e64ffbd69aa6944b9672bcabb6d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd64-3840-4664-8c47-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:56.000Z",
|
|
"modified": "2017-05-13T09:09:56.000Z",
|
|
"first_observed": "2017-05-13T09:09:56Z",
|
|
"last_observed": "2017-05-13T09:09:56Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd64-3840-4664-8c47-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd64-3840-4664-8c47-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/c365ddaa345cfcaff3d629505572a484cff5221933d68e4a52130b8bb7badaf9/analysis/1494630389/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd65-8700-4e03-983a-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:57.000Z",
|
|
"modified": "2017-05-13T09:09:57.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa",
|
|
"pattern": "[file:hashes.SHA1 = '5ff465afaabcbf0150d1a3ab2c2e74f3a4426467']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5916cd65-a6cc-428a-8ac5-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:57.000Z",
|
|
"modified": "2017-05-13T09:09:57.000Z",
|
|
"description": "Observed hash values - Xchecked via VT: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa",
|
|
"pattern": "[file:hashes.MD5 = '84c82835a5d21bbcf75a61706d8ab549']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-05-13T09:09:57Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5916cd65-57a8-4b88-a313-5adf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-05-13T09:09:57.000Z",
|
|
"modified": "2017-05-13T09:09:57.000Z",
|
|
"first_observed": "2017-05-13T09:09:57Z",
|
|
"last_observed": "2017-05-13T09:09:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5916cd65-57a8-4b88-a313-5adf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5916cd65-57a8-4b88-a313-5adf02de0b81",
|
|
"value": "https://www.virustotal.com/file/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa/analysis/1494666158/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |