1753 lines
No EOL
70 KiB
JSON
1753 lines
No EOL
70 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--593133d6-46f4-49e7-b1f6-422f950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:59.000Z",
|
|
"modified": "2017-06-02T15:15:59.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--593133d6-46f4-49e7-b1f6-422f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:59.000Z",
|
|
"modified": "2017-06-02T15:15:59.000Z",
|
|
"name": "M2M - Malspam --> 62909008.pdf",
|
|
"published": "2017-06-02T15:16:05Z",
|
|
"object_refs": [
|
|
"indicator--593133d9-f10c-47f0-a215-4bff950d210f",
|
|
"indicator--593133db-da10-411f-814e-442e950d210f",
|
|
"indicator--593133dc-15f0-48a2-84cd-4792950d210f",
|
|
"indicator--593133de-20e4-4e43-92c2-43b1950d210f",
|
|
"indicator--593133e0-04a8-4f13-ac42-4543950d210f",
|
|
"observed-data--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"network-traffic--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"ipv4-addr--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"indicator--593133e4-5d7c-46e7-8453-416c950d210f",
|
|
"indicator--593133e6-4204-45e9-8211-41cb950d210f",
|
|
"observed-data--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"network-traffic--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"ipv4-addr--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"indicator--593133e9-a094-4b37-ad39-4957950d210f",
|
|
"indicator--593133eb-8198-4f5e-b0da-4fd8950d210f",
|
|
"observed-data--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"network-traffic--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"ipv4-addr--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"indicator--593133f0-bfa8-417a-a021-4249950d210f",
|
|
"indicator--593133f1-7774-407a-b893-4d97950d210f",
|
|
"observed-data--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"network-traffic--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"ipv4-addr--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"indicator--593133f6-42b8-48ad-8929-41af950d210f",
|
|
"indicator--593133f8-9674-43f5-ba2f-470c950d210f",
|
|
"observed-data--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"network-traffic--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"ipv4-addr--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"indicator--593133fc-c6f4-404c-a4c3-46b0950d210f",
|
|
"indicator--593133fe-8118-4284-aada-4945950d210f",
|
|
"observed-data--593133ff-58ec-41df-a867-4991950d210f",
|
|
"network-traffic--593133ff-58ec-41df-a867-4991950d210f",
|
|
"ipv4-addr--593133ff-58ec-41df-a867-4991950d210f",
|
|
"indicator--59313400-05d0-4a96-b874-40f1950d210f",
|
|
"indicator--59313402-bd54-44e5-aca2-47a4950d210f",
|
|
"observed-data--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"network-traffic--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"ipv4-addr--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"indicator--59313406-d784-45ad-86fb-4b21950d210f",
|
|
"indicator--59313408-7f80-410e-8f3c-4a45950d210f",
|
|
"observed-data--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"network-traffic--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"ipv4-addr--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"indicator--5931340b-da7c-4806-857a-4335950d210f",
|
|
"indicator--5931340e-d1fc-4b27-8190-42a8950d210f",
|
|
"observed-data--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"network-traffic--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"ipv4-addr--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"indicator--59313412-87ec-48dc-94fc-4205950d210f",
|
|
"indicator--59313413-5c38-4e69-b62f-4367950d210f",
|
|
"observed-data--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"network-traffic--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"ipv4-addr--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"indicator--59313416-3fbc-41ab-a6c4-4359950d210f",
|
|
"indicator--59313417-036c-4a04-8a39-44f4950d210f",
|
|
"observed-data--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"network-traffic--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"ipv4-addr--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"indicator--59313419-8f00-435b-94e5-4224950d210f",
|
|
"indicator--5931341a-0d84-4991-bfdb-4556950d210f",
|
|
"observed-data--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"network-traffic--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"ipv4-addr--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"indicator--5931341c-690c-445b-8817-48d4950d210f",
|
|
"indicator--5931341d-5bd4-465f-ab05-4ae9950d210f",
|
|
"indicator--59313420-b6cc-4c18-a737-4b85950d210f",
|
|
"indicator--59313421-7d30-4bdd-9172-4bf7950d210f",
|
|
"observed-data--59313422-a36c-426d-8470-40d3950d210f",
|
|
"network-traffic--59313422-a36c-426d-8470-40d3950d210f",
|
|
"ipv4-addr--59313422-a36c-426d-8470-40d3950d210f",
|
|
"indicator--59313424-8b8c-4677-ab56-4fc7950d210f",
|
|
"indicator--59313425-9418-4f28-9425-4492950d210f",
|
|
"observed-data--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"network-traffic--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"ipv4-addr--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"indicator--59313427-fb94-4e62-844b-4217950d210f",
|
|
"indicator--59313428-d794-4b27-a4d3-4157950d210f",
|
|
"observed-data--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"network-traffic--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"ipv4-addr--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"indicator--5931342b-b158-48b4-ba22-4a0f950d210f",
|
|
"indicator--5931342c-9d24-4760-acb9-4eff950d210f",
|
|
"observed-data--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"network-traffic--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"ipv4-addr--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"indicator--59313674-52fc-497a-86fb-41ca02de0b81",
|
|
"indicator--59313675-b4d0-4572-b11d-4fa402de0b81",
|
|
"observed-data--59313676-7ad4-4820-8384-467b02de0b81",
|
|
"url--59313676-7ad4-4820-8384-467b02de0b81",
|
|
"indicator--59313678-1068-434e-9974-42f502de0b81",
|
|
"indicator--59313679-bcac-4e4d-a696-4cfa02de0b81",
|
|
"observed-data--5931367a-5b9c-4764-9fda-4ddd02de0b81",
|
|
"url--5931367a-5b9c-4764-9fda-4ddd02de0b81",
|
|
"indicator--5931367b-b318-4acd-aa54-461b02de0b81",
|
|
"indicator--5931367c-5748-4dd8-b3e7-488d02de0b81",
|
|
"observed-data--5931367d-75b0-46ab-befa-41e302de0b81",
|
|
"url--5931367d-75b0-46ab-befa-41e302de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133d9-f10c-47f0-a215-4bff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'e364235c573d3b60a5f56a124b325da0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133db-da10-411f-814e-442e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[file:hashes.MD5 = '04a20327fc3a5d98c41e0096452bf9e6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133dc-15f0-48a2-84cd-4792950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[file:hashes.MD5 = '603befc50bfcc0a214eacf473ec6baec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133de-20e4-4e43-92c2-43b1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://benefeet.org/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133e0-04a8-4f13-ac42-4543950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'benefeet.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"ipv4-addr--593133e2-d0cc-4f61-ab71-4abe950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"dst_ref": "ipv4-addr--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133e2-d0cc-4f61-ab71-4abe950d210f",
|
|
"value": "76.74.128.210"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133e4-5d7c-46e7-8453-416c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://dsopro.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133e6-4204-45e9-8211-41cb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'dsopro.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"ipv4-addr--593133e8-cb64-4d9f-8706-454a950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"dst_ref": "ipv4-addr--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133e8-cb64-4d9f-8706-454a950d210f",
|
|
"value": "35.166.221.246"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133e9-a094-4b37-ad39-4957950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://eselink.com.my/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133eb-8198-4f5e-b0da-4fd8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'eselink.com.my']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"ipv4-addr--593133ee-dbac-4350-9bcb-49a7950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"dst_ref": "ipv4-addr--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133ee-dbac-4350-9bcb-49a7950d210f",
|
|
"value": "124.150.140.96"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133f0-bfa8-417a-a021-4249950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://e-snhv.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133f1-7774-407a-b893-4d97950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'e-snhv.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"ipv4-addr--593133f5-62a0-423b-bc36-4a56950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"dst_ref": "ipv4-addr--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133f5-62a0-423b-bc36-4a56950d210f",
|
|
"value": "61.106.62.37"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133f6-42b8-48ad-8929-41af950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://fabriquekorea.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133f8-9674-43f5-ba2f-470c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'fabriquekorea.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"ipv4-addr--593133fa-3c50-4981-8b74-47f4950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"dst_ref": "ipv4-addr--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133fa-3c50-4981-8b74-47f4950d210f",
|
|
"value": "211.174.62.52"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133fc-c6f4-404c-a4c3-46b0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://katoconsulting.ro/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--593133fe-8118-4284-aada-4945950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'katoconsulting.ro']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--593133ff-58ec-41df-a867-4991950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--593133ff-58ec-41df-a867-4991950d210f",
|
|
"ipv4-addr--593133ff-58ec-41df-a867-4991950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--593133ff-58ec-41df-a867-4991950d210f",
|
|
"dst_ref": "ipv4-addr--593133ff-58ec-41df-a867-4991950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--593133ff-58ec-41df-a867-4991950d210f",
|
|
"value": "87.229.112.11"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313400-05d0-4a96-b874-40f1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://newserniggrofg.net/af/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313402-bd54-44e5-aca2-47a4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'newserniggrofg.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"ipv4-addr--59313404-77c8-4f47-aba2-4825950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"dst_ref": "ipv4-addr--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313404-77c8-4f47-aba2-4825950d210f",
|
|
"value": "185.195.24.85"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313406-d784-45ad-86fb-4b21950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://orhangazitur.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313408-7f80-410e-8f3c-4a45950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'orhangazitur.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"ipv4-addr--59313409-f2a0-40de-9df1-4ffb950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"dst_ref": "ipv4-addr--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313409-f2a0-40de-9df1-4ffb950d210f",
|
|
"value": "109.232.220.235"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931340b-da7c-4806-857a-4335950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://paradigmenergycorp.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931340e-d1fc-4b27-8190-42a8950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'paradigmenergycorp.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"ipv4-addr--59313410-47dc-468a-bbd3-4978950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"dst_ref": "ipv4-addr--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313410-47dc-468a-bbd3-4978950d210f",
|
|
"value": "107.180.40.126"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313412-87ec-48dc-94fc-4205950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://poltec.com.au/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313413-5c38-4e69-b62f-4367950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'poltec.com.au']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"ipv4-addr--59313414-19a4-4996-88ef-4f11950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"dst_ref": "ipv4-addr--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313414-19a4-4996-88ef-4f11950d210f",
|
|
"value": "27.54.86.236"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313416-3fbc-41ab-a6c4-4359950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://praktikum-marketing.de/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313417-036c-4a04-8a39-44f4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'praktikum-marketing.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"ipv4-addr--59313418-a344-41c0-b999-4a0d950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"dst_ref": "ipv4-addr--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313418-a344-41c0-b999-4a0d950d210f",
|
|
"value": "76.74.235.244"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313419-8f00-435b-94e5-4224950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://pw-shop.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931341a-0d84-4991-bfdb-4556950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'pw-shop.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"ipv4-addr--5931341b-a2a8-46ef-b913-487a950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"dst_ref": "ipv4-addr--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5931341b-a2a8-46ef-b913-487a950d210f",
|
|
"value": "93.170.136.50"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931341c-690c-445b-8817-48d4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://resevesssetornument.com/af/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931341d-5bd4-465f-ab05-4ae9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'resevesssetornument.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313420-b6cc-4c18-a737-4b85950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://tasfirin-ustasi.net/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313421-7d30-4bdd-9172-4bf7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'tasfirin-ustasi.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313422-a36c-426d-8470-40d3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313422-a36c-426d-8470-40d3950d210f",
|
|
"ipv4-addr--59313422-a36c-426d-8470-40d3950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313422-a36c-426d-8470-40d3950d210f",
|
|
"dst_ref": "ipv4-addr--59313422-a36c-426d-8470-40d3950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313422-a36c-426d-8470-40d3950d210f",
|
|
"value": "95.173.189.38"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313424-8b8c-4677-ab56-4fc7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://theexcelconsultant.com/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313425-9418-4f28-9425-4492950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'theexcelconsultant.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"ipv4-addr--59313426-0db8-4df6-91fc-422d950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"dst_ref": "ipv4-addr--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59313426-0db8-4df6-91fc-422d950d210f",
|
|
"value": "65.39.193.50"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313427-fb94-4e62-844b-4217950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://vigs.mx/7rvmnb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313428-d794-4b27-a4d3-4157950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'vigs.mx']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"ipv4-addr--5931342a-e8ac-4fe0-b9e7-4d0b950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"dst_ref": "ipv4-addr--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5931342a-e8ac-4fe0-b9e7-4d0b950d210f",
|
|
"value": "192.185.48.180"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931342b-b158-48b4-ba22-4a0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[url:value = 'http://whoisfoxxrobiouy.net/a5/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931342c-9d24-4760-acb9-4eff950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:56:13.000Z",
|
|
"modified": "2017-06-02T09:56:13.000Z",
|
|
"pattern": "[domain-name:value = 'whoisfoxxrobiouy.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:56:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T15:15:25.000Z",
|
|
"modified": "2017-06-02T15:15:25.000Z",
|
|
"first_observed": "2017-06-02T15:15:25Z",
|
|
"last_observed": "2017-06-02T15:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"ipv4-addr--5931342e-7540-4cb7-a564-4218950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"dst_ref": "ipv4-addr--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5931342e-7540-4cb7-a564-4218950d210f",
|
|
"value": "5.101.66.85"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313674-52fc-497a-86fb-41ca02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:08.000Z",
|
|
"modified": "2017-06-02T09:57:08.000Z",
|
|
"description": "- Xchecked via VT: e364235c573d3b60a5f56a124b325da0",
|
|
"pattern": "[file:hashes.SHA256 = '98f0f68feb0495de61add43c717ccb462fbe46bc977bb295c688bd4511272b55']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313675-b4d0-4572-b11d-4fa402de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:09.000Z",
|
|
"modified": "2017-06-02T09:57:09.000Z",
|
|
"description": "- Xchecked via VT: e364235c573d3b60a5f56a124b325da0",
|
|
"pattern": "[file:hashes.SHA1 = 'fdcf6a75156d3ecae169ceadb6a89d06f9e00410']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59313676-7ad4-4820-8384-467b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:10.000Z",
|
|
"modified": "2017-06-02T09:57:10.000Z",
|
|
"first_observed": "2017-06-02T09:57:10Z",
|
|
"last_observed": "2017-06-02T09:57:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59313676-7ad4-4820-8384-467b02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59313676-7ad4-4820-8384-467b02de0b81",
|
|
"value": "https://www.virustotal.com/file/98f0f68feb0495de61add43c717ccb462fbe46bc977bb295c688bd4511272b55/analysis/1496390071/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313678-1068-434e-9974-42f502de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:12.000Z",
|
|
"modified": "2017-06-02T09:57:12.000Z",
|
|
"description": "- Xchecked via VT: 04a20327fc3a5d98c41e0096452bf9e6",
|
|
"pattern": "[file:hashes.SHA256 = '824901dd0b1660f00c3406cb888118c8a10f66e3258b5020f7ea289434618b13']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59313679-bcac-4e4d-a696-4cfa02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:13.000Z",
|
|
"modified": "2017-06-02T09:57:13.000Z",
|
|
"description": "- Xchecked via VT: 04a20327fc3a5d98c41e0096452bf9e6",
|
|
"pattern": "[file:hashes.SHA1 = 'ed69a648f6bce5e652d24fc7dd3f622b04acb98b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5931367a-5b9c-4764-9fda-4ddd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:14.000Z",
|
|
"modified": "2017-06-02T09:57:14.000Z",
|
|
"first_observed": "2017-06-02T09:57:14Z",
|
|
"last_observed": "2017-06-02T09:57:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5931367a-5b9c-4764-9fda-4ddd02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5931367a-5b9c-4764-9fda-4ddd02de0b81",
|
|
"value": "https://www.virustotal.com/file/824901dd0b1660f00c3406cb888118c8a10f66e3258b5020f7ea289434618b13/analysis/1496392189/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931367b-b318-4acd-aa54-461b02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:15.000Z",
|
|
"modified": "2017-06-02T09:57:15.000Z",
|
|
"description": "- Xchecked via VT: 603befc50bfcc0a214eacf473ec6baec",
|
|
"pattern": "[file:hashes.SHA256 = '312940e15c0251315fb2a8f2920d842fb61f54d5f4d0ce61b60420d972c3c978']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5931367c-5748-4dd8-b3e7-488d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:16.000Z",
|
|
"modified": "2017-06-02T09:57:16.000Z",
|
|
"description": "- Xchecked via VT: 603befc50bfcc0a214eacf473ec6baec",
|
|
"pattern": "[file:hashes.SHA1 = '85a85eb1046aaffd6d4752b38d1a8b1eb3ec2581']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-02T09:57:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5931367d-75b0-46ab-befa-41e302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-02T09:57:17.000Z",
|
|
"modified": "2017-06-02T09:57:17.000Z",
|
|
"first_observed": "2017-06-02T09:57:17Z",
|
|
"last_observed": "2017-06-02T09:57:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5931367d-75b0-46ab-befa-41e302de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5931367d-75b0-46ab-befa-41e302de0b81",
|
|
"value": "https://www.virustotal.com/file/312940e15c0251315fb2a8f2920d842fb61f54d5f4d0ce61b60420d972c3c978/analysis/1496352757/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |