801 lines
No EOL
33 KiB
JSON
801 lines
No EOL
33 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5b3e4d3d-0644-43ef-9ebd-30cd0acd0835",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-10T07:45:45.000Z",
|
|
"modified": "2018-07-10T07:45:45.000Z",
|
|
"name": "Synovus Financial",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5b3e4d3d-0644-43ef-9ebd-30cd0acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-10T07:45:45.000Z",
|
|
"modified": "2018-07-10T07:45:45.000Z",
|
|
"name": "Talos Blog - Smoking Guns - Smoke Loader learned new tricks",
|
|
"published": "2018-08-23T09:22:05Z",
|
|
"object_refs": [
|
|
"indicator--5b3e4dd4-decc-41e8-b689-6b620acd0835",
|
|
"indicator--5b3e4dd4-35dc-4390-9271-6b620acd0835",
|
|
"indicator--5b3e4dd4-e344-4204-a41e-6b620acd0835",
|
|
"indicator--5b3e4dd4-7f38-474b-9086-6b620acd0835",
|
|
"indicator--5b3e4dd4-d810-45b1-8964-6b620acd0835",
|
|
"indicator--5b3e4dd4-59d4-4c9e-ae60-6b620acd0835",
|
|
"indicator--5b3e4dd4-a2f8-4063-b8d4-6b620acd0835",
|
|
"indicator--5b3e4dd4-6a40-44b0-bad4-6b620acd0835",
|
|
"indicator--5b3e4dd4-5f84-4209-b81f-6b620acd0835",
|
|
"indicator--5b3e4dd4-729c-477b-bdd6-6b620acd0835",
|
|
"indicator--5b3e4dd4-0d64-4ef8-8b6c-6b620acd0835",
|
|
"indicator--5b3e4dd4-b574-4ff1-973a-6b620acd0835",
|
|
"indicator--5b3e4dd4-bc0c-4f44-9044-6b620acd0835",
|
|
"indicator--5b3e4dd4-7de4-4060-8fd3-6b620acd0835",
|
|
"indicator--5b3e4dd4-5298-4538-a277-6b620acd0835",
|
|
"indicator--5b3e4dd4-cf4c-45c9-8d53-6b620acd0835",
|
|
"indicator--5b3e4dd4-1eb0-4dd7-8019-6b620acd0835",
|
|
"indicator--5b3e4dd4-7110-4eb7-b035-6b620acd0835",
|
|
"indicator--5b3e4dd4-b308-4e81-8e09-6b620acd0835",
|
|
"indicator--5b3e4dd4-a870-4278-9e99-6b620acd0835",
|
|
"indicator--5b3e4dea-079c-459d-a60c-31250acd0835",
|
|
"indicator--5b3e4dea-ee70-453a-8051-31250acd0835",
|
|
"indicator--5b3e4dea-fcb4-4148-b392-31250acd0835",
|
|
"observed-data--5b3e4e37-8a5c-44a6-9b1a-e7710acd0835",
|
|
"mutex--5b3e4e37-8a5c-44a6-9b1a-e7710acd0835",
|
|
"indicator--5b3e4fdc-f53c-4242-8bd5-31250acd0835",
|
|
"indicator--5b3e4fdc-45cc-4115-baa5-31250acd0835",
|
|
"indicator--5b3e4fdc-4b40-450a-8c1a-31250acd0835",
|
|
"indicator--5b3e4fdd-76a0-469b-93f4-31250acd0835",
|
|
"observed-data--5b3e50a9-979c-4616-9d89-01690acd0835",
|
|
"url--5b3e50a9-979c-4616-9d89-01690acd0835"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"misp-galaxy:tool=\"Smoke Loader\"",
|
|
"misp-galaxy:tool=\"Trick Bot\"",
|
|
"ms-caro-malware-full:malware-family=\"ShellCode\"",
|
|
"trickbot",
|
|
" Smoke Loader"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-decc-41e8-b689-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:47.000Z",
|
|
"modified": "2018-07-05T17:06:47.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.173.34']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-35dc-4390-9271-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '162.247.155.114']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-e344-4204-a41e-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.173.116']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-7f38-474b-9086-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.173.241']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-d810-45b1-8964-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.109.26.121']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-59d4-4c9e-ae60-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.68.93.27']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-a2f8-4063-b8d4-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '137.74.151.148']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-6a40-44b0-bad4-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.223.95.66']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-5f84-4209-b81f-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.143.221.60']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-729c-477b-bdd6-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '195.123.216.115']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-0d64-4ef8-8b6c-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '94.103.82.216']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-b574-4ff1-973a-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:48.000Z",
|
|
"modified": "2018-07-05T17:06:48.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.20.187.13']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-bc0c-4f44-9044-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.242.179.118']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-7de4-4060-8fd3-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.109.26.208']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-5298-4538-a277-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '213.183.51.54']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-cf4c-45c9-8d53-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:48.000Z",
|
|
"modified": "2018-07-05T17:06:48.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.109.24.176']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-1eb0-4dd7-8019-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:48.000Z",
|
|
"modified": "2018-07-05T17:06:48.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.109.27.196']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-7110-4eb7-b035-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:48.000Z",
|
|
"modified": "2018-07-05T17:06:48.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.174.156']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-b308-4e81-8e09-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:48.000Z",
|
|
"modified": "2018-07-05T17:06:48.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.230.112.146']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dd4-a870-4278-9e99-6b620acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:06:49.000Z",
|
|
"modified": "2018-07-05T17:06:49.000Z",
|
|
"description": "Trickbot IPs",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '185.174.174.72']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:06:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
"trickbot"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dea-079c-459d-a60c-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:08:32.000Z",
|
|
"modified": "2018-07-05T17:08:32.000Z",
|
|
"description": "Smoke Loader domains",
|
|
"pattern": "[domain-name:value = 'ukcompany.me']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:08:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
" Smoke Loader"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dea-ee70-453a-8051-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:08:32.000Z",
|
|
"modified": "2018-07-05T17:08:32.000Z",
|
|
"description": "Smoke Loader domains",
|
|
"pattern": "[domain-name:value = 'ukcompany.pw']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:08:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
" Smoke Loader"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4dea-fcb4-4148-b392-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:08:33.000Z",
|
|
"modified": "2018-07-05T17:08:33.000Z",
|
|
"description": "Smoke Loader domains",
|
|
"pattern": "[domain-name:value = 'ukcompany.top']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:08:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\"",
|
|
" Smoke Loader"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b3e4e37-8a5c-44a6-9b1a-e7710acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T16:58:31.000Z",
|
|
"modified": "2018-07-05T16:58:31.000Z",
|
|
"first_observed": "2018-07-05T16:58:31Z",
|
|
"last_observed": "2018-07-05T16:58:31Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"mutex--5b3e4e37-8a5c-44a6-9b1a-e7710acd0835"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\""
|
|
]
|
|
},
|
|
{
|
|
"type": "mutex",
|
|
"spec_version": "2.1",
|
|
"id": "mutex--5b3e4e37-8a5c-44a6-9b1a-e7710acd0835",
|
|
"name": "opera_shared_counter"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4fdc-f53c-4242-8bd5-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:05:32.000Z",
|
|
"modified": "2018-07-05T17:05:32.000Z",
|
|
"description": "IO08784413.doc",
|
|
"pattern": "[file:hashes.SHA256 = 'b98abdbdb85655c64617bb6515df23062ec184fe88d2d6a898b998276a906ebc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:05:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4fdc-45cc-4115-baa5-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:05:32.000Z",
|
|
"modified": "2018-07-05T17:05:32.000Z",
|
|
"description": "B98abdbdb85655c64617bb6515df23062ec184fe88d2d6a898b998276a906ebc",
|
|
"pattern": "[file:name = 'IO08784413.doc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:05:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4fdc-4b40-450a-8c1a-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:05:32.000Z",
|
|
"modified": "2018-07-05T17:05:32.000Z",
|
|
"description": "Trickbot",
|
|
"pattern": "[file:hashes.SHA256 = '0be63a01e2510d161ba9d11e327a55e82dcb5ea07ca1488096dac3e9d4733d41']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:05:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b3e4fdd-76a0-469b-93f4-31250acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:05:33.000Z",
|
|
"modified": "2018-07-05T17:05:33.000Z",
|
|
"description": "Smoke Loader",
|
|
"pattern": "[file:hashes.SHA256 = 'b65806521aa662bff2c655c8a7a3b6c8e598d709e35f3390df880a70c3fded40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-07-05T17:05:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b3e50a9-979c-4616-9d89-01690acd0835",
|
|
"created_by_ref": "identity--5a68c02d-959c-4c8a-a571-0dcac0a8060a",
|
|
"created": "2018-07-05T17:08:57.000Z",
|
|
"modified": "2018-07-05T17:08:57.000Z",
|
|
"first_observed": "2018-07-05T17:08:57Z",
|
|
"last_observed": "2018-07-05T17:08:57Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b3e50a9-979c-4616-9d89-01690acd0835"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b3e50a9-979c-4616-9d89-01690acd0835",
|
|
"value": "https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html?utm_source=feedburner&utm_medium=email&utm_campaign=Feed%3A+feedburner%2FTalos+%28Talos%E2%84%A2+Blog%29"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |