2968 lines
No EOL
131 KiB
JSON
2968 lines
No EOL
131 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5ace0663-370c-40d0-b651-44f4950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:57:01.000Z",
|
|
"modified": "2018-04-11T14:57:01.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5ace0663-370c-40d0-b651-44f4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:57:01.000Z",
|
|
"modified": "2018-04-11T14:57:01.000Z",
|
|
"name": "OSINT - IcedID Banking Trojan Teams up with Rovnix for Distribution",
|
|
"published": "2018-04-11T14:57:19Z",
|
|
"object_refs": [
|
|
"observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f",
|
|
"url--5ace06a2-3540-4b10-93c1-4d5c950d210f",
|
|
"x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f",
|
|
"indicator--5ace0764-684c-435f-947e-4c52950d210f",
|
|
"indicator--5ace0765-c62c-4282-8cbf-42e5950d210f",
|
|
"indicator--5ace0765-1b44-4bee-897b-4a28950d210f",
|
|
"indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f",
|
|
"indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f",
|
|
"indicator--5ace07c0-dde4-4249-a568-4d83950d210f",
|
|
"indicator--5ace07c1-e79c-436d-a3da-4025950d210f",
|
|
"indicator--5ace07c1-9300-4d27-b73a-4c60950d210f",
|
|
"indicator--5ace07c2-50cc-4691-b529-4a6d950d210f",
|
|
"indicator--5ace07c2-4b6c-461f-acbb-4678950d210f",
|
|
"indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f",
|
|
"indicator--5ace07c3-ae30-4de1-8300-432f950d210f",
|
|
"indicator--5ace07c4-8d80-4388-8b65-41a4950d210f",
|
|
"indicator--5ace07c4-202c-40ad-91af-445c950d210f",
|
|
"indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f",
|
|
"indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f",
|
|
"indicator--5ace07c6-c994-477a-8609-49ef950d210f",
|
|
"indicator--5ace07c6-096c-4d43-afa3-41d6950d210f",
|
|
"indicator--5ace07c7-c1f4-4249-854b-4d05950d210f",
|
|
"indicator--5ace07c7-ca7c-4245-9331-41f3950d210f",
|
|
"indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f",
|
|
"indicator--5ace07c9-406c-4a41-95a2-4603950d210f",
|
|
"indicator--5ace07c9-d5e8-408b-99b5-4133950d210f",
|
|
"indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f",
|
|
"indicator--5ace07ca-e130-43b0-a823-4da4950d210f",
|
|
"indicator--5ace07ca-eed4-481c-8342-4cd9950d210f",
|
|
"indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f",
|
|
"indicator--5ace07cc-5b50-4fc6-841f-4332950d210f",
|
|
"indicator--5ace0811-b73c-458b-a293-4c2b950d210f",
|
|
"indicator--5ace0812-6e48-4501-b367-4a2e950d210f",
|
|
"indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d",
|
|
"x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0",
|
|
"indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2",
|
|
"x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f",
|
|
"indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f",
|
|
"x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e",
|
|
"indicator--52993adb-1a53-45a4-94d2-30a610c27fd9",
|
|
"x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67",
|
|
"indicator--82693e02-8fc5-467c-9eba-707ae180d347",
|
|
"x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b",
|
|
"indicator--d8060440-11f0-4674-8694-784e4c5a5325",
|
|
"x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e",
|
|
"indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16",
|
|
"x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863",
|
|
"indicator--6656459f-8619-49cd-84c9-ca816054ee27",
|
|
"x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5",
|
|
"indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2",
|
|
"x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf",
|
|
"indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb",
|
|
"x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e",
|
|
"indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283",
|
|
"x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd",
|
|
"indicator--8e710904-eb33-4fed-9104-5997e11aa525",
|
|
"x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31",
|
|
"indicator--f63376a8-74ab-4697-806c-3cac1c460c50",
|
|
"x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94",
|
|
"indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed",
|
|
"x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e",
|
|
"indicator--99530dee-a6be-43e5-a901-355807d5e959",
|
|
"x-misp-object--a046da2b-64c9-425b-b530-745287082e1f",
|
|
"indicator--dd1084e8-640e-4e9b-9bb3-b15288465629",
|
|
"x-misp-object--b0261080-5394-4a20-935c-104dc477dea0",
|
|
"indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad",
|
|
"x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f",
|
|
"indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f",
|
|
"x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452",
|
|
"indicator--443c8958-7a0a-4505-b809-7c5573c66f0e",
|
|
"x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b",
|
|
"indicator--2228da8c-df64-430c-82ea-408a9961b7af",
|
|
"x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f",
|
|
"indicator--f503491f-6adf-4a8c-adfe-22c83d17b049",
|
|
"x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e",
|
|
"indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec",
|
|
"x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f",
|
|
"indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9",
|
|
"x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2",
|
|
"indicator--06c65048-d1ec-4f49-83f8-69f906fb8426",
|
|
"x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255",
|
|
"indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e",
|
|
"x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f",
|
|
"indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec",
|
|
"x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee",
|
|
"indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95",
|
|
"x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf",
|
|
"indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6",
|
|
"x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7",
|
|
"relationship--688f6ccf-a84a-43ec-9b84-5602976c6e15",
|
|
"relationship--f6853063-3247-4132-a2be-10e2b3c24235",
|
|
"relationship--cb14f429-b289-4ba6-a791-444fa72ac64e",
|
|
"relationship--cf97b6d3-07d8-4fa1-abc3-746730091450",
|
|
"relationship--54a777d9-481e-4863-bf7d-3b33c76a1645",
|
|
"relationship--bae0a96e-c44b-4527-8fbe-08dc4de5ad4c",
|
|
"relationship--e15cfdfa-dfd1-40cb-864d-0234b148b1af",
|
|
"relationship--e0cfd4d2-8d31-4d1c-a963-038d9fda64b0",
|
|
"relationship--c978adcf-a696-47c5-be60-0c27657bd2d9",
|
|
"relationship--2533be41-32bd-4f94-ba55-906b7ca34c2b",
|
|
"relationship--6918a151-65eb-4ded-9549-53c3d6aa5a00",
|
|
"relationship--02fb3f46-5faf-4e03-a48d-207bb0e66e73",
|
|
"relationship--87184a0e-8ef6-45ca-bd90-920d6ce49333",
|
|
"relationship--801418c5-7e2a-428f-8626-0ab5c76fd9c3",
|
|
"relationship--02b8ef81-63f6-404b-8ca5-827442ed734c",
|
|
"relationship--559446de-cfe5-4aeb-9038-721613fb8ec5",
|
|
"relationship--b9f11c13-c05f-42be-bdd4-38060fbff463",
|
|
"relationship--3d7bf31f-273d-406b-b95a-cb17ea814a22",
|
|
"relationship--e3b388f1-ca56-4d2f-bd42-5e8c8e8681a9",
|
|
"relationship--6590363e-7d66-42f8-93a1-e90eeb5cd93a",
|
|
"relationship--d358cb1e-dcaf-46d3-8590-90636b163ca7",
|
|
"relationship--f40d312c-e8b6-4438-a090-a312f6b32e72",
|
|
"relationship--e30a50ee-26cf-4246-a65c-e7059b687976",
|
|
"relationship--cf4e4f7a-91d3-4c9c-badc-0307154a1b8b",
|
|
"relationship--b8802647-2055-40f0-a258-5df7f43ecd07",
|
|
"relationship--ec81a67e-8e78-4377-a684-ade0e86be3a1",
|
|
"relationship--628b6689-645e-4f1f-b871-56a1d2b81d28",
|
|
"relationship--4dec4ab1-7297-4c30-bb93-7e28cc38745c"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:banker=\"IcedID\"",
|
|
"workflow:todo=\"create-missing-misp-galaxy-cluster\"",
|
|
"workflow:todo=\"create-missing-misp-galaxy-cluster-values\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5ace06a2-3540-4b10-93c1-4d5c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:47.000Z",
|
|
"modified": "2018-04-11T14:54:47.000Z",
|
|
"first_observed": "2018-04-11T14:54:47Z",
|
|
"last_observed": "2018-04-11T14:54:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5ace06a2-3540-4b10-93c1-4d5c950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5ace06a2-3540-4b10-93c1-4d5c950d210f",
|
|
"value": "http://blog.talosintelligence.com/2018/04/icedid-banking-trojan.html"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5ace06df-df4c-4cb0-8ae2-4fe0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:48.000Z",
|
|
"modified": "2018-04-11T14:54:48.000Z",
|
|
"labels": [
|
|
"misp:type=\"comment\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "comment",
|
|
"x_misp_value": "Cisco has noticed an increase in infections by the banking trojan IcedID through our Advanced Malware Protection (AMP) system. Security researchers first reported a new banking Trojan known as \"IcedID\" [1] in November 2017. At the time of discovery, IcedID was being distributed by Emotet, another well-known banking trojan malware. In late February and throughout March 2018, we noticed an increase in infections from IcedID being detected throughout the AMP ecosystem. Like in November 2017, some of the infections could be traced to Emotet, but this time, many detections could instead be traced to emails with attached malicious Microsoft Word documents containing macros. When the malicious documents are opened and the macros are enabled, Rovnix, another trojan, would be downloaded and executed, which subsequently downloads IcedID. In addition to Rovnix, many of the samples downloaded a second payload, a Bytecoin miner (Bytecoin is a crypto currency similar to bitcoin)."
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace0764-684c-435f-947e-4c52950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:02:28.000Z",
|
|
"modified": "2018-04-11T13:02:28.000Z",
|
|
"description": "Malicious Document",
|
|
"pattern": "[file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:02:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace0765-c62c-4282-8cbf-42e5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:02:29.000Z",
|
|
"modified": "2018-04-11T13:02:29.000Z",
|
|
"description": "Rovnix",
|
|
"pattern": "[file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:02:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace0765-1b44-4bee-897b-4a28950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:02:29.000Z",
|
|
"modified": "2018-04-11T13:02:29.000Z",
|
|
"description": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)",
|
|
"pattern": "[file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:02:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07bf-5dd8-4cec-aa80-477b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:03:59.000Z",
|
|
"modified": "2018-04-11T13:03:59.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:03:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c0-77ac-417a-87f1-4ea7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:00.000Z",
|
|
"modified": "2018-04-11T13:04:00.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c0-dde4-4249-a568-4d83950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:00.000Z",
|
|
"modified": "2018-04-11T13:04:00.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c1-e79c-436d-a3da-4025950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:01.000Z",
|
|
"modified": "2018-04-11T13:04:01.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c1-9300-4d27-b73a-4c60950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:01.000Z",
|
|
"modified": "2018-04-11T13:04:01.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c2-50cc-4691-b529-4a6d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:02.000Z",
|
|
"modified": "2018-04-11T13:04:02.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c2-4b6c-461f-acbb-4678950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:02.000Z",
|
|
"modified": "2018-04-11T13:04:02.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c3-a1b4-433e-96d1-4b01950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:03.000Z",
|
|
"modified": "2018-04-11T13:04:03.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c3-ae30-4de1-8300-432f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:03.000Z",
|
|
"modified": "2018-04-11T13:04:03.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c4-8d80-4388-8b65-41a4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:04.000Z",
|
|
"modified": "2018-04-11T13:04:04.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c4-202c-40ad-91af-445c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:04.000Z",
|
|
"modified": "2018-04-11T13:04:04.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c5-352c-4d3e-aa85-4d60950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:05.000Z",
|
|
"modified": "2018-04-11T13:04:05.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c5-c2ec-4f1b-b606-4fd0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:05.000Z",
|
|
"modified": "2018-04-11T13:04:05.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c6-c994-477a-8609-49ef950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:06.000Z",
|
|
"modified": "2018-04-11T13:04:06.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c6-096c-4d43-afa3-41d6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:06.000Z",
|
|
"modified": "2018-04-11T13:04:06.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c7-c1f4-4249-854b-4d05950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:07.000Z",
|
|
"modified": "2018-04-11T13:04:07.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c7-ca7c-4245-9331-41f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:07.000Z",
|
|
"modified": "2018-04-11T13:04:07.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c8-8920-4e9f-b40c-4d5d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:08.000Z",
|
|
"modified": "2018-04-11T13:04:08.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c9-406c-4a41-95a2-4603950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:08.000Z",
|
|
"modified": "2018-04-11T13:04:08.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c9-d5e8-408b-99b5-4133950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:09.000Z",
|
|
"modified": "2018-04-11T13:04:09.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07c9-e7c4-43b4-a2a7-4a0b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:09.000Z",
|
|
"modified": "2018-04-11T13:04:09.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07ca-e130-43b0-a823-4da4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:10.000Z",
|
|
"modified": "2018-04-11T13:04:10.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07ca-eed4-481c-8342-4cd9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:10.000Z",
|
|
"modified": "2018-04-11T13:04:10.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07cb-b218-49dc-98d2-4e4a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:11.000Z",
|
|
"modified": "2018-04-11T13:04:11.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace07cc-5b50-4fc6-841f-4332950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T13:04:12.000Z",
|
|
"modified": "2018-04-11T13:04:12.000Z",
|
|
"description": "IcedID binaries",
|
|
"pattern": "[file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T13:04:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace0811-b73c-458b-a293-4c2b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:48.000Z",
|
|
"modified": "2018-04-11T14:54:48.000Z",
|
|
"pattern": "[domain-name:value = 'efoijowufjaowudawd.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5ace0812-6e48-4501-b367-4a2e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:48.000Z",
|
|
"modified": "2018-04-11T14:54:48.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '86.123.64.43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:52.000Z",
|
|
"modified": "2018-04-11T14:54:52.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'de0f64b2cc9cdff5a94ea64828bf90b2' AND file:hashes.SHA1 = '3268a5fcebd1297bdcb12f649d36174d63e15d41' AND file:hashes.SHA256 = '693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:50.000Z",
|
|
"modified": "2018-04-11T14:54:50.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-30T06:28:47",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ba-435c-4cf5-bdb4-403e02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/693599aa847dece5b5cfcca5d545fe5f3f87e5acd10ed807e731741ee306ab4c/analysis/1522391327/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ba-910c-4c87-82af-4c1602de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "43/65",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bb-c0bc-40aa-a922-48a402de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:54.000Z",
|
|
"modified": "2018-04-11T14:54:54.000Z",
|
|
"pattern": "[file:hashes.MD5 = '22ff684a20a1f1ede284761a5c57a384' AND file:hashes.SHA1 = 'e417cd53530be1fcd42f859013c58c16eaac3385' AND file:hashes.SHA256 = '0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:52.000Z",
|
|
"modified": "2018-04-11T14:54:52.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-10T13:22:52",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bc-2de4-4ca2-b500-451502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/0ea7f227bcbc0b7cd9d1d951a8dfde56f8d18989e4f4c2b0290246e282a14842/analysis/1520688172/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bd-7eb0-4c67-85f0-4b9002de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "36/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bd-481c-4bc1-8431-45de02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:56.000Z",
|
|
"modified": "2018-04-11T14:54:56.000Z",
|
|
"pattern": "[file:hashes.MD5 = '02562517436df9302ebb50f2594766f7' AND file:hashes.SHA1 = 'ffbe3d79715cce770bfc61c3f33d32f8c36bb97b' AND file:hashes.SHA256 = '8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:55.000Z",
|
|
"modified": "2018-04-11T14:54:55.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-02T19:13:43",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bf-b0d4-4747-85ea-466f02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/8ce7889ca54f6c480ee3534fbeb2383779583e258b1e4ac5b851b578a40bc31f/analysis/1522696423/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21bf-f27c-462e-a3da-46ca02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "50/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c0-cc30-4577-96c2-446502de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:59.000Z",
|
|
"modified": "2018-04-11T14:54:59.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a63746f323cdeca4b13c2cdcd5463c7a' AND file:hashes.SHA1 = '77fc4e19f659803a379d0fa47008a904af55f54f' AND file:hashes.SHA256 = '995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:54:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:57.000Z",
|
|
"modified": "2018-04-11T14:54:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-06T08:43:30",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c1-43f0-4bc0-8e89-47ba02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/995de239c8160435f50675d42a20cf773e6a3e10c8812f4d680114170e07f914/analysis/1523004210/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c2-077c-4973-b9ac-47b002de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "42/65",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c2-1750-4cb0-8191-40d302de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--82693e02-8fc5-467c-9eba-707ae180d347",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:01.000Z",
|
|
"modified": "2018-04-11T14:55:01.000Z",
|
|
"pattern": "[file:hashes.MD5 = '5933c9c8483252be0bffd8a3bfb4dcc6' AND file:hashes.SHA1 = 'eae0c11f5d7a5004868982152797ee0121d28704' AND file:hashes.SHA256 = '9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:54:59.000Z",
|
|
"modified": "2018-04-11T14:54:59.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-05T20:00:04",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c4-514c-4f5c-9521-41ae02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/9426acf9edf6479374905b743ab0a550183c2b1869af1a8da2bb69a25e2cad1e/analysis/1522958404/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c4-c648-4d32-b174-4c9e02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "50/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c5-222c-4cfe-b70a-43cc02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--d8060440-11f0-4674-8694-784e4c5a5325",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:04.000Z",
|
|
"modified": "2018-04-11T14:55:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = '25672dcae009a4bb84b4095397376146' AND file:hashes.SHA1 = '9f39267a26079cda994a533823194534e00866dc' AND file:hashes.SHA256 = '4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:03.000Z",
|
|
"modified": "2018-04-11T14:55:03.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-22T07:48:09",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c7-9ae8-49e4-b2fa-43f902de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/4c851e40390df6021c8396c9141d50b52d2dc027586a2edb5f682707987adfad/analysis/1521704889/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c7-aa40-4b28-8cf1-450202de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "46/65",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c8-49d4-427c-bd16-40e802de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:07.000Z",
|
|
"modified": "2018-04-11T14:55:07.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd11515bda0737ddbd8fa6dc8e9a6093e' AND file:hashes.SHA1 = '76a5655b74d2b65343f6a5f760a8ba8609691238' AND file:hashes.SHA256 = '84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:05.000Z",
|
|
"modified": "2018-04-11T14:55:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-24T05:23:21",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c9-0e68-4e9b-83ed-417502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/84ecae42c9c88ae5c2bdf51d546421b02d06bcf57b48b2abafdbd38d81bacfa8/analysis/1521869001/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21c9-8a50-4af0-a5a0-41e602de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "36/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ca-f0e4-4771-82d9-455302de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6656459f-8619-49cd-84c9-ca816054ee27",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:09.000Z",
|
|
"modified": "2018-04-11T14:55:09.000Z",
|
|
"pattern": "[file:hashes.MD5 = '073b555c56edc56c220cbbb8cbdc7d1a' AND file:hashes.SHA1 = '34ea6b41d518e3ae16c0b52bf5889c0db1466a98' AND file:hashes.SHA256 = '64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:07.000Z",
|
|
"modified": "2018-04-11T14:55:07.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-11T09:48:06",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21cb-6938-4413-bb6c-47c902de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/64f3abc5b0b65cd4bca68b3200cf2d645d3557fbc6dfe36a127734c3ce436860/analysis/1523440086/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21cc-62e8-4ab0-9f80-441b02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "55/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21cd-3710-47fb-96fc-44ce02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:12.000Z",
|
|
"modified": "2018-04-11T14:55:12.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'f9e3f15a41b6dd4ab25d95a957abee6a' AND file:hashes.SHA1 = '794e1343af82ac981e77a5c086ed9e6c25ecfbc1' AND file:hashes.SHA256 = '5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:10.000Z",
|
|
"modified": "2018-04-11T14:55:10.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-11T09:22:06",
|
|
"category": "Other",
|
|
"comment": "Rovnix",
|
|
"uuid": "5ace21ce-ead0-4911-9180-492902de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5916b8c0c0668d106ebfcad97eb5c90687c873a732eb61f00e5d7033f8fd85ed/analysis/1523438526/",
|
|
"category": "External analysis",
|
|
"comment": "Rovnix",
|
|
"uuid": "5ace21ce-5d4c-4ace-b76e-414802de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/67",
|
|
"category": "Other",
|
|
"comment": "Rovnix",
|
|
"uuid": "5ace21cf-0ee0-43fb-8da8-4b0e02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:14.000Z",
|
|
"modified": "2018-04-11T14:55:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '46e96df14e74915e86a22516d4c111be' AND file:hashes.SHA1 = 'bb948aaa1b0a6f3dd5f5b3b9917411875f100ac3' AND file:hashes.SHA256 = '0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:13.000Z",
|
|
"modified": "2018-04-11T14:55:13.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-02T17:50:19",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d1-dc04-4263-8a3e-4bd702de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/0bd92149834e083320bc5a51f21ac768e26a115c0d589aae22d56ce4c5cf2330/analysis/1522691419/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d1-0658-4e4d-bb9f-4ab902de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "49/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d1-4a20-45b1-ba60-4d8b02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:16.000Z",
|
|
"modified": "2018-04-11T14:55:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd515779b40cac09f1b28caed78406ade' AND file:hashes.SHA1 = 'c944aa2b8b363c671ef9c80eb97ab9465a3b41a2' AND file:hashes.SHA256 = '84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:15.000Z",
|
|
"modified": "2018-04-11T14:55:15.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-05T19:59:15",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d3-dd00-4449-b426-433402de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/84a664fd2ca39c0a7258bed6f8d3e707bcf6c597bb4f94401940b4e005578dae/analysis/1522958355/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d3-0878-4c9c-8c0f-420402de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "39/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d3-1478-4a0a-8079-422102de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--8e710904-eb33-4fed-9104-5997e11aa525",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:19.000Z",
|
|
"modified": "2018-04-11T14:55:19.000Z",
|
|
"pattern": "[file:hashes.MD5 = '60e1089b8a0b4d02981d305ddf60953c' AND file:hashes.SHA1 = '2c320e30337b6e5c18c5abe1734bab125fd571f2' AND file:hashes.SHA256 = 'a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:17.000Z",
|
|
"modified": "2018-04-11T14:55:17.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-02T08:09:27",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d5-08c0-4fae-b03b-40d902de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a88f9196456011043bd404377146f7443550a6f11a08fcfac29a55273bd75509/analysis/1522656567/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d5-efec-42d5-85e8-41d502de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "35/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d6-605c-4780-b782-425802de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f63376a8-74ab-4697-806c-3cac1c460c50",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:21.000Z",
|
|
"modified": "2018-04-11T14:55:21.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'be79cd947879a66db8c1f11b598a250b' AND file:hashes.SHA1 = '4723713da700594f1ba484b7e993e0cdf072b87f' AND file:hashes.SHA256 = '107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:19.000Z",
|
|
"modified": "2018-04-11T14:55:19.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-23T15:24:31",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d8-72bc-4dd9-9e5e-40a602de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/107f44919999afc3ddf9c8d1e552ca8463c71ac53fbeaf62ab7de80aba796e15/analysis/1521818671/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d8-185c-489f-83e4-476c02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "48/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21d8-128c-42d0-ab99-403d02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:23.000Z",
|
|
"modified": "2018-04-11T14:55:23.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd4abe68c54567b9db2bc35a03ae91bc9' AND file:hashes.SHA1 = '6d9e86c0066b21b02b941034389fe4bd96293961' AND file:hashes.SHA256 = '0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:22.000Z",
|
|
"modified": "2018-04-11T14:55:22.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-11T09:45:54",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21da-09ac-4637-a101-45f502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/0ca2971ffedf0704ac5a2b6584f462ce27bac60f17888557dc8cd414558b479e/analysis/1523439954/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21da-7e10-482f-b41d-4dfd02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "52/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21db-eea8-4e6c-98f4-4b1502de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--99530dee-a6be-43e5-a901-355807d5e959",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:26.000Z",
|
|
"modified": "2018-04-11T14:55:26.000Z",
|
|
"pattern": "[file:hashes.MD5 = '86f8c16a3241f99136391428a107c30a' AND file:hashes.SHA1 = 'a4459860666c7ef8006f01c2b787093128f17c11' AND file:hashes.SHA256 = 'b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:24.000Z",
|
|
"modified": "2018-04-11T14:55:24.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-10T08:24:33",
|
|
"category": "Other",
|
|
"comment": "Malicious Document",
|
|
"uuid": "5ace21dc-bb44-48a5-807f-435502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/b0457ecdcc1940850af6d858e2f2e91e555a71f250f53b7ba9d4434a81810032/analysis/1523348673/",
|
|
"category": "External analysis",
|
|
"comment": "Malicious Document",
|
|
"uuid": "5ace21dc-b318-41ac-a08e-403602de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "33/60",
|
|
"category": "Other",
|
|
"comment": "Malicious Document",
|
|
"uuid": "5ace21dd-c404-4f89-8a6a-4d2f02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:28.000Z",
|
|
"modified": "2018-04-11T14:55:28.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1562e6fc78c2b71ece80d783263bef82' AND file:hashes.SHA1 = '2fa2f0738d3c8935ee87427da7d10768282fe139' AND file:hashes.SHA256 = '70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:26.000Z",
|
|
"modified": "2018-04-11T14:55:26.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-30T08:29:37",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21de-d024-4a20-8084-4fe102de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/70e2782079e95e312d7e2de69a6ac0f56874caaf021e1e3f45750f62b7d386ff/analysis/1522398577/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21df-7448-4bdd-92d2-407802de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21df-89b0-466f-9250-454302de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:30.000Z",
|
|
"modified": "2018-04-11T14:55:30.000Z",
|
|
"pattern": "[file:hashes.MD5 = '9e0fca43d0ddfff8198a0885bd264d3a' AND file:hashes.SHA1 = 'e338ef5198c2bd588eb980931582e7705db28866' AND file:hashes.SHA256 = 'ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:28.000Z",
|
|
"modified": "2018-04-11T14:55:28.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-02T19:30:12",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e1-c080-402d-b8a4-4a7c02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ed578c318be8a671b4b3d23db9b3fc4bd031befe490543d60e6bcf0759fc51c5/analysis/1522697412/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e1-f394-4bf6-8267-43bd02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "50/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e1-2dac-489c-b8c0-4aae02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:32.000Z",
|
|
"modified": "2018-04-11T14:55:32.000Z",
|
|
"pattern": "[file:hashes.MD5 = '6bf4004030ce5238ec2b130d6ce861b9' AND file:hashes.SHA1 = '0d6f36b77d30db9c08c830da8fe0e30312d18515' AND file:hashes.SHA256 = 'a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:31.000Z",
|
|
"modified": "2018-04-11T14:55:31.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-28T21:41:05",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e3-48bc-48c2-922a-4dde02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a5779442a31d66407cec78d1d58832a847d5929587cb22b8ad7459f4a28deeef/analysis/1522273265/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e3-11d8-4390-a4ba-491202de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "27/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e4-ad54-450a-bc97-43e902de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:35.000Z",
|
|
"modified": "2018-04-11T14:55:35.000Z",
|
|
"pattern": "[file:hashes.MD5 = '6d1c4739b4a9cb7b78930a45687402b1' AND file:hashes.SHA1 = '2cb241c465a7300b6d4c1f3fc9d58daa53e424c7' AND file:hashes.SHA256 = 'd5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:33.000Z",
|
|
"modified": "2018-04-11T14:55:33.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-06T07:50:13",
|
|
"category": "Other",
|
|
"comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)",
|
|
"uuid": "5ace21e5-22c0-4dc7-b0dc-441502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/d5164e296c7e7a0c3b2a9e34f07bebcdd0ab7df9ab63ca7dffac6d65e60b0b25/analysis/1523001013/",
|
|
"category": "External analysis",
|
|
"comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)",
|
|
"uuid": "5ace21e5-6bc0-4abf-991f-425302de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "42/66",
|
|
"category": "Other",
|
|
"comment": "Unpacked IcedID binary demonstrating injection (see hook on ntdll!ZwCreateUserProcess at 0x4016a6)",
|
|
"uuid": "5ace21e6-9750-42d0-971c-43da02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--2228da8c-df64-430c-82ea-408a9961b7af",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:37.000Z",
|
|
"modified": "2018-04-11T14:55:37.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'f25b97573927299e975d786e2a42bd32' AND file:hashes.SHA1 = '7d79296d9cfe36cca96997c2983b3b820e25ffed' AND file:hashes.SHA256 = '7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:35.000Z",
|
|
"modified": "2018-04-11T14:55:35.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-19T18:35:27",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e7-14b4-413f-b893-499202de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7700fe76b40bc4a0f1b93ae32b9f34c595ef0e2886632e26ebf5f43be1aea63c/analysis/1521484527/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e8-fabc-4f31-9eef-4b6302de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "47/65",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e8-7d24-45bb-b059-491702de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:39.000Z",
|
|
"modified": "2018-04-11T14:55:39.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1a9323b210ec81404aa509b9079fd71e' AND file:hashes.SHA1 = 'd12766fd4a4275d48cc94c20c6bb0cf7878352c7' AND file:hashes.SHA256 = '1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:37.000Z",
|
|
"modified": "2018-04-11T14:55:37.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-26T00:31:21",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21e9-66b4-4a67-8ff4-4e9402de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/1f8b4e2ef4c318625447884156be50691555e409242252e504ab15ade5bba4d8/analysis/1522024281/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ea-79ac-44a8-95d5-4f6d02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "29/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ea-8d60-4c30-9996-4e6902de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:41.000Z",
|
|
"modified": "2018-04-11T14:55:41.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'dcd0ca97e1f341bcca4dbcf0facc7908' AND file:hashes.SHA1 = '607dce9aa1d528701e7fb6439560673f3ed799d6' AND file:hashes.SHA256 = 'da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:40.000Z",
|
|
"modified": "2018-04-11T14:55:40.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-14T19:08:10",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ec-3e98-44c0-b97c-4af202de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/da1e9b6766b9a6445c77ac522a73cc763be2f2500fb1ed8af63e2c47e0f884fb/analysis/1521054490/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ec-02e0-442b-a470-42b702de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "43/64",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ed-bb90-47d5-929c-42e302de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:44.000Z",
|
|
"modified": "2018-04-11T14:55:44.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'e16d5492bfb200fe4269988868c185e0' AND file:hashes.SHA1 = '73bc3b6561e3864f3fc5a719c369c95b00ac800d' AND file:hashes.SHA256 = '8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:42.000Z",
|
|
"modified": "2018-04-11T14:55:42.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-23T13:59:34",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ee-8dd4-4848-9a4b-422d02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/8408fd2fab0b7fce952d6338164040eeb5ae910cbf355ea41f798e04998507bc/analysis/1521813574/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ef-39e4-4821-865e-4d7802de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "45/67",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21ef-79f8-4758-9e96-42bc02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:46.000Z",
|
|
"modified": "2018-04-11T14:55:46.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'c28f58ce162bc146a5d44e2473e39210' AND file:hashes.SHA1 = 'e340fec254c3e813726f6fc8939dc8486ec76082' AND file:hashes.SHA256 = 'ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:44.000Z",
|
|
"modified": "2018-04-11T14:55:44.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-05T20:21:19",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f1-c4bc-4b23-9575-4b1102de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/ffc7479a186f1101a9e7800d8830d235ba6797dc293ade57864f2db26fa58c0f/analysis/1522959679/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f1-17cc-4486-940f-408f02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "51/65",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f1-5068-49a3-89fb-457002de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:48.000Z",
|
|
"modified": "2018-04-11T14:55:48.000Z",
|
|
"pattern": "[file:hashes.MD5 = '1aefa7f9824f775504550360b5cc90c0' AND file:hashes.SHA1 = '9d3745c8ab300c6df60732923e328482f2ca52bd' AND file:hashes.SHA256 = '24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:47.000Z",
|
|
"modified": "2018-04-11T14:55:47.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-25T13:10:29",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f3-87bc-4035-97d4-498a02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/24bde557761930ec48a6573c2f7f538be784652e7c55224ba474e443bd1d8c55/analysis/1521983429/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f3-bc18-48c3-86ed-4a6202de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "42/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f4-9a24-40ca-bc4c-45ee02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:51.000Z",
|
|
"modified": "2018-04-11T14:55:51.000Z",
|
|
"pattern": "[file:hashes.MD5 = '7b56a528f8f6155555fa360b3c36c8da' AND file:hashes.SHA1 = 'f4d2bd10a6a16b4fca17507483e963e194389f65' AND file:hashes.SHA256 = '9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:51Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:49.000Z",
|
|
"modified": "2018-04-11T14:55:49.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-04-10T21:29:30",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f5-d428-40bb-ae55-44fb02de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/9b5930266d5494553f3801d62d7ef20dc866fadda0ee654da85e01042aa91338/analysis/1523395770/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f6-410c-47a2-9b82-46ee02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "54/66",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f6-6ad8-4a0d-a010-474b02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:53.000Z",
|
|
"modified": "2018-04-11T14:55:53.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'e3b5fe82eb8f4162b1d4d6d861447ecf' AND file:hashes.SHA1 = '2093fbf65cbe5fed4289f4ce252527cc0ff0b9c3' AND file:hashes.SHA256 = 'e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:51.000Z",
|
|
"modified": "2018-04-11T14:55:51.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-07T01:24:50",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f7-4134-4212-bc2a-4a3602de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e899b27d0e241914cba36c43dfb686bf008237d10beff9114f9aad04b7c919de/analysis/1520385890/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f8-c38c-45dd-ab89-48dc02de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "45/68",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21f8-a18c-41e0-8975-4d2a02de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3c6a6ca8a46a6adf19a0d3b1b0a7be27' AND file:hashes.SHA1 = 'a21db84f0d6c67e5550a421a23998adf2ad1082a' AND file:hashes.SHA256 = '7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-04-11T14:55:55Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-04-11T14:55:54.000Z",
|
|
"modified": "2018-04-11T14:55:54.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-03-22T08:55:19",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21fa-ff58-410e-8e7e-41b502de0b81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7c89b72451f7361cc3f120d0c38287fe5acc9f6e8210279cfe09318d6fe92869/analysis/1521708919/",
|
|
"category": "External analysis",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21fa-5f88-4533-a756-498402de0b81"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "47/68",
|
|
"category": "Other",
|
|
"comment": "IcedID binaries",
|
|
"uuid": "5ace21fb-8f14-4523-a9bd-451902de0b81"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--688f6ccf-a84a-43ec-9b84-5602976c6e15",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--2bc43e30-aad8-4cfe-8b81-6278dc5f379d",
|
|
"target_ref": "x-misp-object--7356e593-a254-40dc-a9fc-cc3097082ec0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f6853063-3247-4132-a2be-10e2b3c24235",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--9d02783e-3b55-4812-a175-0f6a5723b9b2",
|
|
"target_ref": "x-misp-object--8804329c-ddaa-49c7-be35-93876273c67f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cb14f429-b289-4ba6-a791-444fa72ac64e",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--b720682a-33ee-4acd-bb6f-51e4a1cee39f",
|
|
"target_ref": "x-misp-object--504cc2f6-9851-4bf3-a1f6-b9a84c97067e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cf97b6d3-07d8-4fa1-abc3-746730091450",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--52993adb-1a53-45a4-94d2-30a610c27fd9",
|
|
"target_ref": "x-misp-object--59492ad3-2ee2-4392-8dea-8453b7040c67"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--54a777d9-481e-4863-bf7d-3b33c76a1645",
|
|
"created": "2018-04-11T14:55:55.000Z",
|
|
"modified": "2018-04-11T14:55:55.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--82693e02-8fc5-467c-9eba-707ae180d347",
|
|
"target_ref": "x-misp-object--c7ee13b7-32d0-4c0d-9017-7ddfec33e02b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--bae0a96e-c44b-4527-8fbe-08dc4de5ad4c",
|
|
"created": "2018-04-11T14:55:56.000Z",
|
|
"modified": "2018-04-11T14:55:56.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--d8060440-11f0-4674-8694-784e4c5a5325",
|
|
"target_ref": "x-misp-object--85ad4dc3-f78d-4801-807e-aeba3082767e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e15cfdfa-dfd1-40cb-864d-0234b148b1af",
|
|
"created": "2018-04-11T14:55:56.000Z",
|
|
"modified": "2018-04-11T14:55:56.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--68ee4e84-8ae1-41b8-8234-e6c754ceda16",
|
|
"target_ref": "x-misp-object--36ced79c-295d-4940-9cf8-e76ccc283863"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e0cfd4d2-8d31-4d1c-a963-038d9fda64b0",
|
|
"created": "2018-04-11T14:55:56.000Z",
|
|
"modified": "2018-04-11T14:55:56.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6656459f-8619-49cd-84c9-ca816054ee27",
|
|
"target_ref": "x-misp-object--f93ed223-e3f7-49f1-848f-ad5db448ffd5"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--c978adcf-a696-47c5-be60-0c27657bd2d9",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--c26ea7da-a977-42cb-8d5e-391a9efec8a2",
|
|
"target_ref": "x-misp-object--5bab0717-3cc2-4e37-80d1-963b979f28bf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2533be41-32bd-4f94-ba55-906b7ca34c2b",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--2e8aca83-efe2-4f29-9430-7714a56aecbb",
|
|
"target_ref": "x-misp-object--f3fb8e23-4ca8-449c-b327-7b2b27f85a1e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6918a151-65eb-4ded-9549-53c3d6aa5a00",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--8df3ae73-42f3-4ba3-87e7-04c4be578283",
|
|
"target_ref": "x-misp-object--1fa2e353-ac87-47bf-8bf3-b635e06c5fcd"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--02fb3f46-5faf-4e03-a48d-207bb0e66e73",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--8e710904-eb33-4fed-9104-5997e11aa525",
|
|
"target_ref": "x-misp-object--e1ff779a-c2bc-4ed9-a18f-815cb5791c31"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--87184a0e-8ef6-45ca-bd90-920d6ce49333",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f63376a8-74ab-4697-806c-3cac1c460c50",
|
|
"target_ref": "x-misp-object--51e911da-e139-4bb4-8339-dfe5bd2e4f94"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--801418c5-7e2a-428f-8626-0ab5c76fd9c3",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--b1ce2cc9-5d81-442e-85a0-15f0148d20ed",
|
|
"target_ref": "x-misp-object--964fb53d-7228-4f0d-8d81-ebfe0d47ba2e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--02b8ef81-63f6-404b-8ca5-827442ed734c",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--99530dee-a6be-43e5-a901-355807d5e959",
|
|
"target_ref": "x-misp-object--a046da2b-64c9-425b-b530-745287082e1f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--559446de-cfe5-4aeb-9038-721613fb8ec5",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--dd1084e8-640e-4e9b-9bb3-b15288465629",
|
|
"target_ref": "x-misp-object--b0261080-5394-4a20-935c-104dc477dea0"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b9f11c13-c05f-42be-bdd4-38060fbff463",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--40b689ad-909c-4bdf-b60b-7e2434a0d2ad",
|
|
"target_ref": "x-misp-object--ba176916-70c3-4a01-9d39-fb2d46d49b1f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--3d7bf31f-273d-406b-b95a-cb17ea814a22",
|
|
"created": "2018-04-11T14:55:57.000Z",
|
|
"modified": "2018-04-11T14:55:57.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--650e0658-1a9a-49d3-a71c-2bca2c81575f",
|
|
"target_ref": "x-misp-object--ca1f75bb-eaa2-4681-85cd-2238ab5a3452"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e3b388f1-ca56-4d2f-bd42-5e8c8e8681a9",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--443c8958-7a0a-4505-b809-7c5573c66f0e",
|
|
"target_ref": "x-misp-object--14e75518-cf2c-4585-84bc-ea25bf34373b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6590363e-7d66-42f8-93a1-e90eeb5cd93a",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--2228da8c-df64-430c-82ea-408a9961b7af",
|
|
"target_ref": "x-misp-object--af3cf082-332b-4814-a96a-da533f84c06f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d358cb1e-dcaf-46d3-8590-90636b163ca7",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f503491f-6adf-4a8c-adfe-22c83d17b049",
|
|
"target_ref": "x-misp-object--632d79f8-fee2-4258-8898-5d1e0a7c729e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f40d312c-e8b6-4438-a090-a312f6b32e72",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6c538a2a-8a0d-4562-b2e2-f9c5317dc1ec",
|
|
"target_ref": "x-misp-object--d1f89b92-435b-48bd-87f3-088663f1dd9f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--e30a50ee-26cf-4246-a65c-e7059b687976",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6d44632f-9fc4-4d8b-aeb3-2173dd9ea4e9",
|
|
"target_ref": "x-misp-object--581ddc5b-72c1-4fe5-8d1c-6b51ae761ec2"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--cf4e4f7a-91d3-4c9c-badc-0307154a1b8b",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--06c65048-d1ec-4f49-83f8-69f906fb8426",
|
|
"target_ref": "x-misp-object--082bcc2c-2673-464d-a3d5-038d83c53255"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b8802647-2055-40f0-a258-5df7f43ecd07",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--33ffdc21-76a4-4a9d-8483-2621db37e09e",
|
|
"target_ref": "x-misp-object--0a4652ca-2a5a-4f46-9b74-58569181df1f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ec81a67e-8e78-4377-a684-ade0e86be3a1",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f3107367-b8b2-4966-9adf-2541a70aa7ec",
|
|
"target_ref": "x-misp-object--719a0ad9-8c06-45d6-9f58-9a552fcf39ee"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--628b6689-645e-4f1f-b871-56a1d2b81d28",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--21f75cd7-6a6b-4031-a122-06380ee2fd95",
|
|
"target_ref": "x-misp-object--fb3889d5-e301-4ae5-8e3f-f064ba25fedf"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4dec4ab1-7297-4c30-bb93-7e28cc38745c",
|
|
"created": "2018-04-11T14:55:58.000Z",
|
|
"modified": "2018-04-11T14:55:58.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--017b5770-d46e-4885-85b0-bcec1fb85ec6",
|
|
"target_ref": "x-misp-object--f1d72ac1-ab69-4d3e-a4a2-ee45e597e4d7"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |