691 lines
No EOL
31 KiB
JSON
691 lines
No EOL
31 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5948c00e-8440-4137-9952-a922950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:44:06.000Z",
|
|
"modified": "2017-06-20T06:44:06.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5948c00e-8440-4137-9952-a922950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:44:06.000Z",
|
|
"modified": "2017-06-20T06:44:06.000Z",
|
|
"name": "OSINT - McAfee Discovers Pinkslipbot Exploiting Infected Machines as Control Servers; Releases Free Tool to Detect, Disable Trojan",
|
|
"published": "2017-06-20T08:03:23Z",
|
|
"object_refs": [
|
|
"x-misp-attribute--5948c01e-5cd4-40b5-ac70-41e5950d210f",
|
|
"observed-data--5948c02a-1448-47b2-a635-a8a6950d210f",
|
|
"url--5948c02a-1448-47b2-a635-a8a6950d210f",
|
|
"indicator--5948c03c-c7b0-4892-a21a-4510950d210f",
|
|
"indicator--5948c03c-9cb4-4ad8-8426-4e9b950d210f",
|
|
"indicator--5948c048-b978-4ded-8d45-a8a6950d210f",
|
|
"indicator--5948c048-4fbc-4cfc-9656-a8a6950d210f",
|
|
"indicator--5948c048-d744-4618-aefa-a8a6950d210f",
|
|
"indicator--5948c080-02e0-41ff-8840-43e6950d210f",
|
|
"indicator--5948c080-f950-44f1-bd9e-460b950d210f",
|
|
"indicator--5948c080-3e10-492e-a85b-4b99950d210f",
|
|
"indicator--5948c080-7620-4a6f-a9c1-4916950d210f",
|
|
"indicator--5948c1df-8824-4967-96d5-40d902de0b81",
|
|
"indicator--5948c1df-c12c-42db-b424-46f002de0b81",
|
|
"observed-data--5948c1df-9fa4-4268-a4f1-45f802de0b81",
|
|
"url--5948c1df-9fa4-4268-a4f1-45f802de0b81",
|
|
"indicator--5948c1df-2078-4d5e-9b04-436302de0b81",
|
|
"indicator--5948c1df-2cd0-4953-9158-4f4202de0b81",
|
|
"observed-data--5948c1df-80d0-4d6c-95b3-486e02de0b81",
|
|
"url--5948c1df-80d0-4d6c-95b3-486e02de0b81",
|
|
"indicator--5948c1df-fb74-4e22-8fa4-447902de0b81",
|
|
"indicator--5948c1df-5098-4512-9ecc-4cb802de0b81",
|
|
"observed-data--5948c1df-bb38-4800-8ceb-464002de0b81",
|
|
"url--5948c1df-bb38-4800-8ceb-464002de0b81",
|
|
"indicator--5948c1df-bad0-4298-9deb-47bd02de0b81",
|
|
"indicator--5948c1df-c0a8-417d-9604-44eb02de0b81",
|
|
"observed-data--5948c1df-b440-4f96-a30d-498c02de0b81",
|
|
"url--5948c1df-b440-4f96-a30d-498c02de0b81",
|
|
"indicator--5948c1df-1810-4198-81c6-4b3102de0b81",
|
|
"indicator--5948c1df-261c-4bd6-857c-400d02de0b81",
|
|
"observed-data--5948c1df-85cc-494c-9319-435e02de0b81",
|
|
"url--5948c1df-85cc-494c-9319-435e02de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:tool=\"Akbot\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5948c01e-5cd4-40b5-ac70-41e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "McAfee Labs has discovered that banking malware Pinkslipbot (also known as QakBot/QBot) has used infected machines as control servers since April 2016, even after its capability to steal personal and financial data from the infected machine has been removed by a security product. These include home users whose computers are usually behind a network address translation router. To do so, Pinkslipbot uses universal plug and play (UPnP) to open ports, allowing incoming connections from anyone on the Internet to communicate with the infected machine. As far as we know, Pinkslipbot is the first malware to use infected machines as HTTPS-based control servers and the second executable-based malware to use UPnP for port forwarding after the infamous W32/Conficker worm in 2008.\r\nPinkslipbot is a notorious banking-credential harvester that has been active since 2007. It primarily targets users and enterprises located within the United States and includes components for password stealers, keyloggers, and man-in-the-browser attacks that are used as vectors to steal various kinds of information\u00e2\u20ac\u201dincluding credit cards, social security numbers, online account credentials, email passwords, digital certificates, etc. Pinkslipbot controls a large botnet of more than 500,000 infected machines and steals over a half-million records every day. As a result, this malware has been documented extensively by the antimalware industry. The malware authors are clearly benefiting from Pinkslipbot; they have maintained the code base since 2007 and regularly add new features to it."
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c02a-1448-47b2-a635-a8a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c02a-1448-47b2-a635-a8a6950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c02a-1448-47b2-a635-a8a6950d210f",
|
|
"value": "https://securingtomorrow.mcafee.com/mcafee-labs/mcafee-discovers-pinkslipbot-exploiting-infected-machines-as-control-servers-releases-free-tool-to-detect-disable-trojan/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c03c-c7b0-4892-a21a-4510950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers",
|
|
"pattern": "[file:hashes.SHA256 = '22cf76f92aad53db1304dec026b834ad77d2272c7f2eaaabf299e953b98d570e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c03c-9cb4-4ad8-8426-4e9b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers",
|
|
"pattern": "[file:hashes.SHA256 = 'c23fe9f3a3035edb6fa306c7545cfd05bb310d85983dda5914cd9650c13b41d3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c048-b978-4ded-8d45-a8a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll)",
|
|
"pattern": "[file:hashes.SHA256 = '730e9864795ed8d6538064551ab95505dff3e92dd67888bee323cb341b2420c6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c048-4fbc-4cfc-9656-a8a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll)",
|
|
"pattern": "[file:hashes.SHA256 = 'af25c5bed96e046ba1e25749ff51f0d8437a1ef66e469b4fd0348e372abc2f7f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c048-d744-4618-aefa-a8a6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll)",
|
|
"pattern": "[file:hashes.SHA256 = '6d174dd4f29da814170e8f7c40ecd80794e1c27d8d94741a79bd1bd6eb75ea62']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c080-02e0-41ff-8840-43e6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"pattern": "[file:name = '\\\\%APPDATA\\\\%\\\\HardwareMonitor\\\\hardwaremonitor.dll']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c080-f950-44f1-bd9e-460b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"pattern": "[file:name = '\\\\%ALLUSERSPROFILE\\\\%\\\\HardwareMonitor\\\\hardwaremonitor.dll']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c080-3e10-492e-a85b-4b99950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"pattern": "[file:name = '\\\\%APPDATA\\\\%\\\\HardwareMonitor\\\\hardwaremonitor.ini']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c080-7620-4a6f-a9c1-4916950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"pattern": "[file:name = '\\\\%ALLUSERSPROFILE\\\\%\\\\HardwareMonitor\\\\hardwaremonitor.ini']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-8824-4967-96d5-40d902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: 6d174dd4f29da814170e8f7c40ecd80794e1c27d8d94741a79bd1bd6eb75ea62",
|
|
"pattern": "[file:hashes.SHA1 = '61979d13bb058424ce585a867148a4cda91c0998']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-c12c-42db-b424-46f002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: 6d174dd4f29da814170e8f7c40ecd80794e1c27d8d94741a79bd1bd6eb75ea62",
|
|
"pattern": "[file:hashes.MD5 = 'cebfd6d9b0290f933d95be059ea9342c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c1df-9fa4-4268-a4f1-45f802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c1df-9fa4-4268-a4f1-45f802de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c1df-9fa4-4268-a4f1-45f802de0b81",
|
|
"value": "https://www.virustotal.com/file/6d174dd4f29da814170e8f7c40ecd80794e1c27d8d94741a79bd1bd6eb75ea62/analysis/1497765996/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-2078-4d5e-9b04-436302de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: af25c5bed96e046ba1e25749ff51f0d8437a1ef66e469b4fd0348e372abc2f7f",
|
|
"pattern": "[file:hashes.SHA1 = '8fb933995998728aa86da88f7a3b9189412abcdf']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-2cd0-4953-9158-4f4202de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: af25c5bed96e046ba1e25749ff51f0d8437a1ef66e469b4fd0348e372abc2f7f",
|
|
"pattern": "[file:hashes.MD5 = '91e7262e72ba0cb3e71e00f540ab9f73']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c1df-80d0-4d6c-95b3-486e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c1df-80d0-4d6c-95b3-486e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c1df-80d0-4d6c-95b3-486e02de0b81",
|
|
"value": "https://www.virustotal.com/file/af25c5bed96e046ba1e25749ff51f0d8437a1ef66e469b4fd0348e372abc2f7f/analysis/1497666460/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-fb74-4e22-8fa4-447902de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: 730e9864795ed8d6538064551ab95505dff3e92dd67888bee323cb341b2420c6",
|
|
"pattern": "[file:hashes.SHA1 = '48e7f341d2a887fcbb2974c57f7269ec00c29c85']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-5098-4512-9ecc-4cb802de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component DLL (internal name: supernode_con.dll) - Xchecked via VT: 730e9864795ed8d6538064551ab95505dff3e92dd67888bee323cb341b2420c6",
|
|
"pattern": "[file:hashes.MD5 = '72e300fd8a27d1d8afc42dd4b47f7a42']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c1df-bb38-4800-8ceb-464002de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c1df-bb38-4800-8ceb-464002de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c1df-bb38-4800-8ceb-464002de0b81",
|
|
"value": "https://www.virustotal.com/file/730e9864795ed8d6538064551ab95505dff3e92dd67888bee323cb341b2420c6/analysis/1497666456/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-bad0-4298-9deb-47bd02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers - Xchecked via VT: c23fe9f3a3035edb6fa306c7545cfd05bb310d85983dda5914cd9650c13b41d3",
|
|
"pattern": "[file:hashes.SHA1 = '56d9dfe06b3847d99c30ce0a8b527e2572eb8d06']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-c0a8-417d-9604-44eb02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers - Xchecked via VT: c23fe9f3a3035edb6fa306c7545cfd05bb310d85983dda5914cd9650c13b41d3",
|
|
"pattern": "[file:hashes.MD5 = 'e8e32892204adc612fdcfbc73abd60a0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c1df-b440-4f96-a30d-498c02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c1df-b440-4f96-a30d-498c02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c1df-b440-4f96-a30d-498c02de0b81",
|
|
"value": "https://www.virustotal.com/file/c23fe9f3a3035edb6fa306c7545cfd05bb310d85983dda5914cd9650c13b41d3/analysis/1497316605/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-1810-4198-81c6-4b3102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers - Xchecked via VT: 22cf76f92aad53db1304dec026b834ad77d2272c7f2eaaabf299e953b98d570e",
|
|
"pattern": "[file:hashes.SHA1 = 'c60a05988932f64e60e8482523043f9aded610c7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5948c1df-261c-4bd6-857c-400d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"description": "Proxy component droppers - Xchecked via VT: 22cf76f92aad53db1304dec026b834ad77d2272c7f2eaaabf299e953b98d570e",
|
|
"pattern": "[file:hashes.MD5 = '80b6422d6edd2efb3bdc8751ae94efe9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-06-20T06:34:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5948c1df-85cc-494c-9319-435e02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-06-20T06:34:07.000Z",
|
|
"modified": "2017-06-20T06:34:07.000Z",
|
|
"first_observed": "2017-06-20T06:34:07Z",
|
|
"last_observed": "2017-06-20T06:34:07Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5948c1df-85cc-494c-9319-435e02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5948c1df-85cc-494c-9319-435e02de0b81",
|
|
"value": "https://www.virustotal.com/file/22cf76f92aad53db1304dec026b834ad77d2272c7f2eaaabf299e953b98d570e/analysis/1497898598/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |