1411 lines
No EOL
56 KiB
JSON
1411 lines
No EOL
56 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--59ccca18-b2fc-4249-8c20-49fd950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--59ccca18-b2fc-4249-8c20-49fd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"name": "M2M - Locky 2017-09-27 : Affid=3, offline, \".ykcol\" : \"Scanned image from MX-2600N\" - \"20170927_123456.7z\"",
|
|
"published": "2017-09-29T13:07:45Z",
|
|
"object_refs": [
|
|
"indicator--59ccca19-e7bc-41aa-9755-4c55950d210f",
|
|
"indicator--59ccca19-27c0-4fc9-9f41-431c950d210f",
|
|
"indicator--59ccca19-8a44-4121-add6-4253950d210f",
|
|
"observed-data--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"network-traffic--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"ipv4-addr--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"indicator--59ccca1a-a4ec-425d-ba06-4df4950d210f",
|
|
"indicator--59ccca1a-1acc-407f-9206-494e950d210f",
|
|
"observed-data--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"network-traffic--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"ipv4-addr--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"indicator--59ccca1b-ea74-4440-948d-4571950d210f",
|
|
"indicator--59ccca1b-3d50-48a7-9547-4883950d210f",
|
|
"observed-data--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"network-traffic--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"ipv4-addr--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"indicator--59ccca1b-0e20-4e60-bcc8-4415950d210f",
|
|
"indicator--59ccca1b-d1d4-4761-9bf5-4445950d210f",
|
|
"observed-data--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"network-traffic--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"ipv4-addr--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"indicator--59ccca1c-0710-4e8f-b78c-4c92950d210f",
|
|
"indicator--59ccca1c-97b8-4e9d-92da-4f34950d210f",
|
|
"observed-data--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"network-traffic--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"ipv4-addr--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"indicator--59ccca1d-f3f8-4ee6-9cc2-4432950d210f",
|
|
"indicator--59ccca1d-9b40-453c-9325-4e49950d210f",
|
|
"observed-data--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"network-traffic--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"ipv4-addr--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"indicator--59ccca1e-c54c-4133-9680-45cf950d210f",
|
|
"indicator--59ccca1e-4f58-45c4-9326-438d950d210f",
|
|
"observed-data--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"network-traffic--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"ipv4-addr--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"indicator--59ccca1e-ddd0-4582-a51b-4a5a950d210f",
|
|
"indicator--59ccca1f-44d4-48eb-9d44-4324950d210f",
|
|
"observed-data--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"network-traffic--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"ipv4-addr--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"indicator--59ccca1f-45c8-44e2-8f41-47e5950d210f",
|
|
"indicator--59ccca1f-4d24-4ef7-94c8-4335950d210f",
|
|
"observed-data--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"network-traffic--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"ipv4-addr--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"indicator--59ccca20-212c-45c8-acb9-4700950d210f",
|
|
"indicator--59ccca20-8980-4ca3-bce4-45ca950d210f",
|
|
"observed-data--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"network-traffic--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"ipv4-addr--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"indicator--59ccca21-2844-410b-8bf2-407b950d210f",
|
|
"indicator--59ccca21-e85c-492e-82c4-43e4950d210f",
|
|
"observed-data--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"network-traffic--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"ipv4-addr--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"indicator--59ccca21-35c4-4dd1-a121-4e86950d210f",
|
|
"indicator--59ccca22-9bcc-49b0-95df-47f2950d210f",
|
|
"observed-data--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"network-traffic--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"ipv4-addr--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"indicator--59ccca22-c564-4462-b7f1-4373950d210f",
|
|
"indicator--59ccca22-eb8c-43f9-a006-475b950d210f",
|
|
"observed-data--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"network-traffic--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"ipv4-addr--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"indicator--59ccca23-a6e8-4ebb-b50b-44e5950d210f",
|
|
"indicator--59ccca23-09f8-4cfc-85f2-4103950d210f",
|
|
"indicator--59ccca41-3204-4881-8aaa-4fab950d210f",
|
|
"indicator--59ccca41-c0a4-4f8f-acc8-4136950d210f",
|
|
"observed-data--59ccca41-c174-40af-828b-4973950d210f",
|
|
"network-traffic--59ccca41-c174-40af-828b-4973950d210f",
|
|
"ipv4-addr--59ccca41-c174-40af-828b-4973950d210f",
|
|
"indicator--59ccca48-59a0-42a3-b65a-4c1d02de0b81",
|
|
"indicator--59ccca48-578c-4e68-a971-4d7a02de0b81",
|
|
"observed-data--59ccca48-de94-482b-9489-4baf02de0b81",
|
|
"url--59ccca48-de94-482b-9489-4baf02de0b81",
|
|
"observed-data--59ce45a1-3ff8-4e6a-a052-79d102de0b81",
|
|
"url--59ce45a1-3ff8-4e6a-a052-79d102de0b81"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"ecsirt:malicious-code=\"ransomware\"",
|
|
"misp-galaxy:ransomware=\"Locky\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca19-e7bc-41aa-9755-4c55950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'dd4d46b9612efc391469bba8553358b6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca19-27c0-4fc9-9f41-431c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://aeaccting.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca19-8a44-4121-add6-4253950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'aeaccting.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"ipv4-addr--59ccca1a-d7e4-49ed-acde-458f950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1a-d7e4-49ed-acde-458f950d210f",
|
|
"value": "208.67.23.166"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1a-a4ec-425d-ba06-4df4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://asecontrids.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1a-1acc-407f-9206-494e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'asecontrids.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"ipv4-addr--59ccca1a-cebc-4657-8a62-4f08950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1a-cebc-4657-8a62-4f08950d210f",
|
|
"value": "107.190.129.218"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1b-ea74-4440-948d-4571950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://ashapeforlife.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1b-3d50-48a7-9547-4883950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'ashapeforlife.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"ipv4-addr--59ccca1b-6730-41ef-8202-4ae9950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1b-6730-41ef-8202-4ae9950d210f",
|
|
"value": "198.46.85.238"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1b-0e20-4e60-bcc8-4415950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://ashtontan.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1b-d1d4-4761-9bf5-4445950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'ashtontan.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"ipv4-addr--59ccca1c-9b44-45fc-a8f5-49c1950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1c-9b44-45fc-a8f5-49c1950d210f",
|
|
"value": "103.6.198.208"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1c-0710-4e8f-b78c-4c92950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://avsaroglubisiklet.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1c-97b8-4e9d-92da-4f34950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'avsaroglubisiklet.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"ipv4-addr--59ccca1d-ea74-403f-b883-437f950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1d-ea74-403f-b883-437f950d210f",
|
|
"value": "188.132.232.70"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1d-f3f8-4ee6-9cc2-4432950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://bhs-news.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1d-9b40-453c-9325-4e49950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'bhs-news.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"ipv4-addr--59ccca1e-223c-4e44-b453-4943950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1e-223c-4e44-b453-4943950d210f",
|
|
"value": "50.28.39.131"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1e-c54c-4133-9680-45cf950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://borcom.de/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1e-4f58-45c4-9326-438d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'borcom.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"ipv4-addr--59ccca1e-8be0-4430-86cb-4b8c950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1e-8be0-4430-86cb-4b8c950d210f",
|
|
"value": "83.220.144.30"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1e-ddd0-4582-a51b-4a5a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[url:value = 'http://bosphorustekneleri.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1f-44d4-48eb-9d44-4324950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"pattern": "[domain-name:value = 'bosphorustekneleri.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"ipv4-addr--59ccca1f-e198-4f18-87a8-4bd7950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca1f-e198-4f18-87a8-4bd7950d210f",
|
|
"value": "209.140.18.67"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1f-45c8-44e2-8f41-47e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://consultingfranquean.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca1f-4d24-4ef7-94c8-4335950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'consultingfranquean.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"ipv4-addr--59ccca20-77bc-416e-b2fd-4d97950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca20-77bc-416e-b2fd-4d97950d210f",
|
|
"value": "151.80.184.39"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca20-212c-45c8-acb9-4700950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://cortaestanciapolanco.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca20-8980-4ca3-bce4-45ca950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'cortaestanciapolanco.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"ipv4-addr--59ccca20-1994-481e-8e48-4aeb950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca20-1994-481e-8e48-4aeb950d210f",
|
|
"value": "63.247.141.99"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca21-2844-410b-8bf2-407b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://crna-macka.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca21-e85c-492e-82c4-43e4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'crna-macka.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"ipv4-addr--59ccca21-cf98-48b4-8d2f-41e0950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca21-cf98-48b4-8d2f-41e0950d210f",
|
|
"value": "212.72.103.166"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca21-35c4-4dd1-a121-4e86950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://dic-astra.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca22-9bcc-49b0-95df-47f2950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'dic-astra.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"ipv4-addr--59ccca22-a5f0-4b5d-a304-4d8a950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca22-a5f0-4b5d-a304-4d8a950d210f",
|
|
"value": "138.201.161.139"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca22-c564-4462-b7f1-4373950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://gug-gummi.com/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca22-eb8c-43f9-a006-475b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'gug-gummi.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"ipv4-addr--59ccca23-21ac-4fc4-9b53-4120950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca23-21ac-4fc4-9b53-4120950d210f",
|
|
"value": "78.138.88.232"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca23-a6e8-4ebb-b50b-44e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://poemsan.info/p66/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca23-09f8-4cfc-85f2-4103950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'poemsan.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca41-3204-4881-8aaa-4fab950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[url:value = 'http://www.fasching-hallbergmoos.de/d8743fgh']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca41-c0a4-4f8f-acc8-4136950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"pattern": "[domain-name:value = 'www.fasching-hallbergmoos.de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca41-c174-40af-828b-4973950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--59ccca41-c174-40af-828b-4973950d210f",
|
|
"ipv4-addr--59ccca41-c174-40af-828b-4973950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--59ccca41-c174-40af-828b-4973950d210f",
|
|
"dst_ref": "ipv4-addr--59ccca41-c174-40af-828b-4973950d210f",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--59ccca41-c174-40af-828b-4973950d210f",
|
|
"value": "78.138.88.40"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca48-59a0-42a3-b65a-4c1d02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"description": "- Xchecked via VT: dd4d46b9612efc391469bba8553358b6",
|
|
"pattern": "[file:hashes.SHA256 = '3e55a7a405e4c4e4ad6d19296ac512d6c32441d5a65419cd116faa672b11963c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--59ccca48-578c-4e68-a971-4d7a02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"description": "- Xchecked via VT: dd4d46b9612efc391469bba8553358b6",
|
|
"pattern": "[file:hashes.SHA1 = 'b83fa30809ca80e981546cf1bae8f3f9a9cca206']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2017-09-29T13:07:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ccca48-de94-482b-9489-4baf02de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:44.000Z",
|
|
"modified": "2017-09-29T13:07:44.000Z",
|
|
"first_observed": "2017-09-29T13:07:44Z",
|
|
"last_observed": "2017-09-29T13:07:44Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59ccca48-de94-482b-9489-4baf02de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59ccca48-de94-482b-9489-4baf02de0b81",
|
|
"value": "https://www.virustotal.com/file/3e55a7a405e4c4e4ad6d19296ac512d6c32441d5a65419cd116faa672b11963c/analysis/1506591639/"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--59ce45a1-3ff8-4e6a-a052-79d102de0b81",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2017-09-29T13:07:45.000Z",
|
|
"modified": "2017-09-29T13:07:45.000Z",
|
|
"first_observed": "2017-09-29T13:07:45Z",
|
|
"last_observed": "2017-09-29T13:07:45Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--59ce45a1-3ff8-4e6a-a052-79d102de0b81"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--59ce45a1-3ff8-4e6a-a052-79d102de0b81",
|
|
"value": "https://www.virustotal.com/file/3e55a7a405e4c4e4ad6d19296ac512d6c32441d5a65419cd116faa672b11963c/analysis/1506685598/"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |