4351 lines
No EOL
186 KiB
JSON
4351 lines
No EOL
186 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5b6d858f-6cb0-4a06-b826-57f5950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:20:28.000Z",
|
|
"modified": "2018-10-03T11:20:28.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5b6d858f-6cb0-4a06-b826-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:20:28.000Z",
|
|
"modified": "2018-10-03T11:20:28.000Z",
|
|
"name": "OSINT - Skygofree: Following in the footsteps of HackingTeam",
|
|
"published": "2018-10-03T11:22:15Z",
|
|
"object_refs": [
|
|
"observed-data--5b6d869f-b8cc-460b-99fa-a199950d210f",
|
|
"url--5b6d869f-b8cc-460b-99fa-a199950d210f",
|
|
"x-misp-attribute--5b6d8769-acd4-435a-a6d6-7e1e950d210f",
|
|
"observed-data--5b6d8809-0244-4327-9791-7cfd950d210f",
|
|
"url--5b6d8809-0244-4327-9791-7cfd950d210f",
|
|
"indicator--5b6d8916-d718-4b4a-8a41-57f5950d210f",
|
|
"indicator--5b6d8917-bcbc-4524-b1bc-57f5950d210f",
|
|
"indicator--5b6d8917-1438-4e0f-8fd5-57f5950d210f",
|
|
"indicator--5b6d8918-3c0c-4fca-a73b-57f5950d210f",
|
|
"indicator--5b6d8918-9248-4584-902d-57f5950d210f",
|
|
"indicator--5b6d8919-3f18-4f18-9ba5-57f5950d210f",
|
|
"indicator--5b6d8919-a254-4b06-b0ab-57f5950d210f",
|
|
"indicator--5b6d891a-f264-4f58-bab4-57f5950d210f",
|
|
"indicator--5b6d891a-c58c-46e2-8cc5-57f5950d210f",
|
|
"indicator--5b6d891a-3414-4db2-bca9-57f5950d210f",
|
|
"indicator--5b6d891b-ad98-4150-85ad-57f5950d210f",
|
|
"indicator--5b6d891c-2734-4ee8-9fc0-57f5950d210f",
|
|
"indicator--5b6d891e-fdc4-42d3-ba1a-57f5950d210f",
|
|
"indicator--5b6d891f-558c-4449-864e-57f5950d210f",
|
|
"indicator--5b6d8920-9a20-4b37-9365-57f5950d210f",
|
|
"indicator--5b6d8921-5af0-41ca-b69f-57f5950d210f",
|
|
"indicator--5b6d8923-6370-4714-ba67-57f5950d210f",
|
|
"indicator--5b6d8924-b234-44da-a068-57f5950d210f",
|
|
"indicator--5b6d8925-2c00-4026-82e3-57f5950d210f",
|
|
"indicator--5b6d8d91-1b94-4522-8633-cbfc950d210f",
|
|
"indicator--5b6d90f1-3bf4-4746-a265-4d62950d210f",
|
|
"indicator--5b6d9fab-3cf0-4839-8421-cc8c950d210f",
|
|
"indicator--5b6da192-aa4c-4141-9993-b712950d210f",
|
|
"indicator--5b6da23b-5980-40d9-b40e-fc18950d210f",
|
|
"indicator--5b6da2c9-e668-4985-a4c1-a1dd950d210f",
|
|
"indicator--5b6da343-5348-45c3-88f4-4756950d210f",
|
|
"indicator--5b6da485-3f88-4f5a-90e6-4750950d210f",
|
|
"indicator--5b6da4fd-d71c-4b44-883c-b711950d210f",
|
|
"indicator--5b6da52c-53d8-4052-832e-7cfd950d210f",
|
|
"indicator--5b6da574-aeb4-4d95-af75-7d0f950d210f",
|
|
"indicator--5b6da5a9-55e4-4e73-b66d-e737950d210f",
|
|
"indicator--5b6da5da-1b0c-41b0-b0d9-a198950d210f",
|
|
"indicator--5b6da61e-8dd4-4656-ba3b-cbf1950d210f",
|
|
"indicator--5b7e9771-afcc-4953-9591-a3d0950d210f",
|
|
"indicator--5b7ea118-b9ec-4598-b96a-49b7950d210f",
|
|
"indicator--5b7ea243-31a0-4e2b-bb58-4fbe950d210f",
|
|
"indicator--5b8d3a80-f2b8-475d-8b6d-4d87950d210f",
|
|
"indicator--5b8d3a82-73ec-481e-b96e-4136950d210f",
|
|
"indicator--5b8d3a86-ad44-4523-8f8a-49a7950d210f",
|
|
"indicator--5b8d3a8a-a3cc-42f1-8c76-4b5a950d210f",
|
|
"indicator--5b8d3a8f-57dc-43f8-87db-466b950d210f",
|
|
"indicator--5b8d3a93-9ca4-4dee-8a6d-4b53950d210f",
|
|
"indicator--5b8d3a98-2cf4-4a25-a3a9-4d8d950d210f",
|
|
"indicator--5b8d3a9c-86d4-4eab-afab-46a4950d210f",
|
|
"indicator--5b8d3aa0-c450-4c78-a711-4162950d210f",
|
|
"indicator--5b8d3aa5-59f8-40ba-bcfd-461a950d210f",
|
|
"indicator--5b8d3aa9-402c-476e-8a8f-41b7950d210f",
|
|
"indicator--5b8d3aad-c6b0-4bf4-b585-46e3950d210f",
|
|
"indicator--5b8d3ab2-e240-442e-b612-4ac6950d210f",
|
|
"indicator--5b8d3ab6-a73c-4f1d-982c-4590950d210f",
|
|
"indicator--5b8d3aba-54d0-4e0a-8721-42ce950d210f",
|
|
"observed-data--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"network-traffic--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"ipv4-addr--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"observed-data--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"network-traffic--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"ipv4-addr--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"observed-data--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"network-traffic--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"ipv4-addr--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"observed-data--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"network-traffic--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"ipv4-addr--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"observed-data--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"network-traffic--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"ipv4-addr--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"observed-data--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"network-traffic--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"ipv4-addr--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"observed-data--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"network-traffic--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"ipv4-addr--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"observed-data--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"network-traffic--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"ipv4-addr--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"observed-data--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"network-traffic--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"ipv4-addr--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"indicator--5b6d8b20-12a8-4910-aeae-57f5950d210f",
|
|
"indicator--5b6d8bac-aa38-4fd7-b277-7d0f950d210f",
|
|
"indicator--5b6d8c99-441c-4305-9431-4a6f950d210f",
|
|
"observed-data--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"file--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"directory--5b7e9b4a-76d0-4f5e-9f37-fc04950d210f",
|
|
"indicator--5b6d923b-1720-4be7-a432-cc41950d210f",
|
|
"indicator--5b6d92d3-3150-429c-8aaa-b711950d210f",
|
|
"indicator--5b6d9322-cf1c-4259-bed4-a179950d210f",
|
|
"indicator--5b6d9345-e134-4ff7-ae7d-cd92950d210f",
|
|
"indicator--5b6d93f0-8528-4aa3-b1ea-4666950d210f",
|
|
"indicator--5b6d942f-1c14-47ff-92c6-cc71950d210f",
|
|
"indicator--5b6d9459-7168-46b5-b31c-cc71950d210f",
|
|
"indicator--5b6d9480-6300-4946-a56c-cc54950d210f",
|
|
"indicator--5b6d94ae-15c4-4c52-a4b0-a1de950d210f",
|
|
"indicator--5b6d94fd-4258-4009-9aaf-cc71950d210f",
|
|
"indicator--5b6d952c-48a4-4f24-8b5f-7cfd950d210f",
|
|
"indicator--5b6d956a-4d40-426d-baaa-a197950d210f",
|
|
"indicator--5b6d9595-20e0-4fe6-add9-cc54950d210f",
|
|
"indicator--5b6d9b83-f57c-49d1-8d6e-cc8c950d210f",
|
|
"indicator--5b6d9c4f-7290-45f0-ac9e-cbf1950d210f",
|
|
"indicator--5b6d9d0f-9fbc-47c4-b8ef-fc06950d210f",
|
|
"indicator--5b6d9d6d-1848-48ca-8d1c-cd99950d210f",
|
|
"indicator--5b6d9e03-619c-4049-9557-7cfd950d210f",
|
|
"indicator--5b6d9e59-14a8-4925-a9c1-cc8c950d210f",
|
|
"indicator--5b6d9e85-048c-4c1a-ace7-fc06950d210f",
|
|
"indicator--5b6d9eae-1e14-48eb-95ae-e737950d210f",
|
|
"indicator--5b6d9ed4-4744-46d8-bf6b-cd92950d210f",
|
|
"indicator--5b6d9ef9-33e0-49f8-afc4-a1dd950d210f",
|
|
"indicator--5b6d9f15-302c-4528-b5b7-e737950d210f",
|
|
"observed-data--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"file--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"directory--5b7e9b99-3d00-433e-b666-441e950d210f",
|
|
"observed-data--5b6da202-2654-49e0-93dd-a1dd950d210f",
|
|
"file--5b6da202-2654-49e0-93dd-a1dd950d210f",
|
|
"observed-data--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"file--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"directory--5b7e9bd8-8ef0-40c5-b985-4835950d210f",
|
|
"observed-data--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"file--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"directory--5b7e99bd-a06c-44b8-85de-4dbd950d210f",
|
|
"vulnerability--5b7141f1-ca14-400c-879d-8bd7950d210f",
|
|
"indicator--5b7ea077-cfbc-4059-9ac0-4554950d210f",
|
|
"vulnerability--5b8d2e5e-fd90-47bd-941d-4e98950d210f",
|
|
"vulnerability--5b8d306d-ed34-4a9c-9350-49ca950d210f",
|
|
"vulnerability--5b8d34d9-a7ac-407e-8faf-4357950d210f",
|
|
"vulnerability--5b8d38fc-abb0-4860-8182-73ee950d210f",
|
|
"indicator--ef468365-addd-40d5-a24d-543722f12e93",
|
|
"x-misp-object--68dc24db-7625-4d35-b6d3-c6fb1283bf18",
|
|
"indicator--6ccf462a-1c20-452a-be71-cfe9936ed3ba",
|
|
"x-misp-object--d2f2004d-2309-4a22-99cd-031a09bde2f1",
|
|
"indicator--7d3abf61-6c8e-47c1-93eb-d9f5103a9d5e",
|
|
"x-misp-object--b822f813-8192-409c-8ccc-27c368ce781a",
|
|
"indicator--cacbd9c4-03d0-435d-ad3c-a31a568e8d8e",
|
|
"x-misp-object--60d09241-1457-4f27-8c62-a010c19eeb21",
|
|
"indicator--93f7c2d4-3eda-4a19-aba6-b3bdb34be6c6",
|
|
"x-misp-object--fa8c321e-5cde-45bb-a01c-7e2a2a09b969",
|
|
"indicator--6bf27c78-9d3b-4926-9c37-ec97cf90fee5",
|
|
"x-misp-object--22999236-217f-4117-ae67-135d962de74e",
|
|
"indicator--a4995eaf-38d1-4aed-a189-061d8ad9eb5b",
|
|
"x-misp-object--28a0ab9f-4372-42ba-bea6-9a437f2c55e6",
|
|
"indicator--19019d95-d653-45c4-a76a-e1d0514ea188",
|
|
"x-misp-object--a6f536ba-7227-4404-a445-3859005c2d85",
|
|
"indicator--dddd50b2-9d97-476a-864e-021d7986d6fb",
|
|
"x-misp-object--497f5b93-ac74-4869-b34e-e18258a06405",
|
|
"indicator--f43d2055-c298-4014-b16c-cb31bb84171b",
|
|
"x-misp-object--f9620a5e-f529-47ca-b57b-52959ee91051",
|
|
"indicator--aa457e4c-9f49-4f78-84ec-5d60a7c157a2",
|
|
"x-misp-object--8af76320-edcc-4b95-bdbd-bf638bd1e369",
|
|
"indicator--790fef27-93cc-4a9f-803a-b320db0dee95",
|
|
"x-misp-object--f234144d-1765-4cf4-b8ad-6d6f1a2b6472",
|
|
"indicator--6ff856c9-fa6e-454c-ba8c-0fc21d5cc864",
|
|
"x-misp-object--41755892-e078-4a46-87e8-1f5e2677e25c",
|
|
"indicator--09391239-3536-4168-8f87-72ae9d533bef",
|
|
"x-misp-object--d85d218a-03c1-40d8-9b3f-b88bb3f6e132",
|
|
"indicator--bd4d9903-64a2-48b5-9aca-8daaf2bcc0ee",
|
|
"x-misp-object--57bf09f8-10dd-40e1-b635-be7748f76773",
|
|
"indicator--1e7e2181-e880-4274-9ddf-f8daa44549c7",
|
|
"x-misp-object--084b441e-ce8b-4086-ad6c-0ef1e2b2c78b",
|
|
"indicator--43892c3f-9a1b-466c-9bee-8e397cfe7d99",
|
|
"x-misp-object--d57f6827-03ab-40da-9465-a87640bda410",
|
|
"relationship--7ff1f83d-e138-4575-9d54-4b8c2b16b428",
|
|
"relationship--4f7ca7c8-da7c-4ca0-b995-d776223c2a4c",
|
|
"relationship--efee5afc-d453-436e-a7dd-725a0903206a",
|
|
"relationship--ee173b9a-d87f-4cf5-914c-aedb9e565cd2",
|
|
"relationship--a07bca2b-2a1d-4827-a673-057ae7bc39a8",
|
|
"relationship--dbe48377-59a3-4247-b765-2104c59785f5",
|
|
"relationship--11d0bf8a-0461-4dc4-b0a4-7e1a92b3ff33",
|
|
"relationship--f00740af-0b9e-4a38-bc3d-6ee875911ae2",
|
|
"relationship--14e218b6-19c1-436a-9566-e2544ca12946",
|
|
"relationship--b4791049-89b2-4497-9b06-c03d9c6d8e3a",
|
|
"relationship--51e0d8fa-26cc-44ff-be5c-5e168ce8a701",
|
|
"relationship--80759dc6-6d60-462b-bc88-e3b4f0213699",
|
|
"relationship--8f552d0f-e23b-43fa-a880-848eda1feee5",
|
|
"relationship--71b19f2e-ec2a-44d6-9332-9886502e6440",
|
|
"relationship--105a692b-088c-47a3-b854-13f7b9eeab3b",
|
|
"relationship--d862dd3b-0a86-431d-8801-52143abb6198",
|
|
"relationship--02d08b30-f1b2-4d3e-939a-e72e65aa02c0",
|
|
"relationship--9a1184df-617a-43be-b140-6d4a4c2d6dd9",
|
|
"relationship--56e6c00d-e1fc-4cab-b092-d05bfcbf29d2",
|
|
"relationship--6c007664-1714-41cb-832f-02e3632fe85a",
|
|
"relationship--f40ba5b5-3cd1-434c-8f2d-af072f02f9b1",
|
|
"relationship--39dcf14c-d6ff-4617-b305-1ff152c23976",
|
|
"relationship--fd3fe726-19ad-49f7-aa11-511a11d18d6b",
|
|
"relationship--d266e507-907e-4a72-b713-69b81f0b8a3c"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"osint:source-type=\"blog-post\"",
|
|
"misp-galaxy:android=\"Skygofree\"",
|
|
"Android Malware",
|
|
"ms-caro-malware:malware-platform=\"AndroidOS\"",
|
|
"ms-caro-malware-full:malware-platform=\"AndroidOS\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6d869f-b8cc-460b-99fa-a199950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:39:40.000Z",
|
|
"modified": "2018-08-10T12:39:40.000Z",
|
|
"first_observed": "2018-08-10T12:39:40Z",
|
|
"last_observed": "2018-08-10T12:39:40Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b6d869f-b8cc-460b-99fa-a199950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b6d869f-b8cc-460b-99fa-a199950d210f",
|
|
"value": "https://securelist.com/skygofree-following-in-the-footsteps-of-hackingteam/83603/"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--5b6d8769-acd4-435a-a6d6-7e1e950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:39:56.000Z",
|
|
"modified": "2018-08-10T12:39:56.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "At the beginning of October 2017, we discovered new Android spyware with several features previously unseen in the wild. In the course of further research, we found a number of related samples that point to a long-term development process. We believe the initial versions of this malware were created at least three years ago \u00e2\u20ac\u201c at the end of 2014. Since then, the implant\u00e2\u20ac\u2122s functionality has been improving and remarkable new features implemented, such as the ability to record audio surroundings via the microphone when an infected device is in a specified location; the stealing of WhatsApp messages via Accessibility Services; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals.\r\nWe observed many web landing pages that mimic the sites of mobile operators and which are used to spread the Android implants. These domains have been registered by the attackers since 2015. According to our telemetry, that was the year the distribution campaign was at its most active. The activities continue: the most recently observed domain was registered on October 31, 2017. Based on our KSN statistics, there are several infected individuals, exclusively in Italy.\r\nMoreover, as we dived deeper into the investigation, we discovered several spyware tools for Windows that form an implant for exfiltrating sensitive data on a targeted machine. The version we found was built at the beginning of 2017, and at the moment we are not sure whether this implant has been used in the wild.We named the malware Skygofree, because we found the word in one of the domains*"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6d8809-0244-4327-9791-7cfd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:42:12.000Z",
|
|
"modified": "2018-08-10T12:42:12.000Z",
|
|
"first_observed": "2018-08-10T12:42:12Z",
|
|
"last_observed": "2018-08-10T12:42:12Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5b6d8809-0244-4327-9791-7cfd950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"technical-report\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5b6d8809-0244-4327-9791-7cfd950d210f",
|
|
"value": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07164028/Skygofree_appendix_eng.pdf"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8916-d718-4b4a-8a41-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:14.000Z",
|
|
"modified": "2018-08-10T12:46:14.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = '119.network']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8917-bcbc-4524-b1bc-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:15.000Z",
|
|
"modified": "2018-08-10T12:46:15.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = '119.business']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8917-1438-4e0f-8fd5-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:15.000Z",
|
|
"modified": "2018-08-10T12:46:15.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'timbox.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8918-3c0c-4fca-a73b-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:16.000Z",
|
|
"modified": "2018-08-10T12:46:16.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'vodafoneinfinity.sytes.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8918-9248-4584-902d-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:16.000Z",
|
|
"modified": "2018-08-10T12:46:16.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'vodafone.press']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8919-3f18-4f18-9ba5-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:17.000Z",
|
|
"modified": "2018-08-10T12:46:17.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'voda.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8919-a254-4b06-b0ab-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:17.000Z",
|
|
"modified": "2018-08-10T12:46:17.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = '190.network']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891a-f264-4f58-bab4-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:18.000Z",
|
|
"modified": "2018-08-10T12:46:18.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'tre.support']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891a-c58c-46e2-8cc5-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:18.000Z",
|
|
"modified": "2018-08-10T12:46:18.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = '3g.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891a-3414-4db2-bca9-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:18.000Z",
|
|
"modified": "2018-08-10T12:46:18.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'h3g.co']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891b-ad98-4150-85ad-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:19.000Z",
|
|
"modified": "2018-08-10T12:46:19.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'h3g.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891c-2734-4ee8-9fc0-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:20.000Z",
|
|
"modified": "2018-08-10T12:46:20.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = '155wind.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891e-fdc4-42d3-ba1a-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:22.000Z",
|
|
"modified": "2018-08-10T12:46:22.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'wind.support']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d891f-558c-4449-864e-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:23.000Z",
|
|
"modified": "2018-08-10T12:46:23.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'windupdate.serveftp.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8920-9a20-4b37-9365-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:24.000Z",
|
|
"modified": "2018-08-10T12:46:24.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'skygofree.sytes.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8921-5af0-41ca-b69f-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:25.000Z",
|
|
"modified": "2018-08-10T12:46:25.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'digimobil.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8923-6370-4714-ba67-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:27.000Z",
|
|
"modified": "2018-08-10T12:46:27.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'kenamobile.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8924-b234-44da-a068-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:28.000Z",
|
|
"modified": "2018-08-10T12:46:28.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'lycamobile.mobi']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8925-2c00-4026-82e3-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:46:29.000Z",
|
|
"modified": "2018-08-10T12:46:29.000Z",
|
|
"description": "Domains related to distribution campaign",
|
|
"pattern": "[domain-name:value = 'postemobile.help']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:46:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8d91-1b94-4522-8633-cbfc950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:05:21.000Z",
|
|
"modified": "2018-08-10T13:05:21.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '217.194.13.133']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:05:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d90f1-3bf4-4746-a265-4d62950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_AU']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9fab-3cf0-4839-8421-cc8c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_K']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da192-aa4c-4141-9993-b712950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_xboz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da23b-5980-40d9-b40e-fc18950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_SE']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da2c9-e668-4985-a4c1-a1dd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_scren']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da343-5348-45c3-88f4-4756950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:14:23.000Z",
|
|
"modified": "2018-10-03T11:14:23.000Z",
|
|
"pattern": "[mutex:name = 'mutex_var_Re_v_5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-10-03T11:14:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Artifacts dropped"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"mutex\"",
|
|
"misp:category=\"Artifacts dropped\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da485-3f88-4f5a-90e6-4750950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:44:11.000Z",
|
|
"modified": "2018-08-10T14:44:11.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[domain-name:value = 'url.plus']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:44:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da4fd-d71c-4b44-883c-b711950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:45:17.000Z",
|
|
"modified": "2018-08-10T14:45:17.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[domain-name:value = 'negg.ddns.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:45:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da52c-53d8-4052-832e-7cfd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:46:35.000Z",
|
|
"modified": "2018-08-10T14:46:35.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[domain-name:value = 'negg1.ddns.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:46:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da574-aeb4-4d95-af75-7d0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:47:16.000Z",
|
|
"modified": "2018-08-10T14:47:16.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[domain-name:value = 'negg2.ddns.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:47:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da5a9-55e4-4e73-b66d-e737950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:48:09.000Z",
|
|
"modified": "2018-08-10T14:48:09.000Z",
|
|
"description": "Platform Android, Comment and Control Server",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '79.3.197.89']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:48:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da5da-1b0c-41b0-b0d9-a198950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:48:58.000Z",
|
|
"modified": "2018-08-10T14:48:58.000Z",
|
|
"description": "Platforms Android and Windows, Comment and Control Server",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '54.67.109.199']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:48:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6da61e-8dd4-4656-ba3b-cbf1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:50:06.000Z",
|
|
"modified": "2018-08-10T14:50:06.000Z",
|
|
"description": "Platform Windows, Comment and Control Server",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '80.21.172.8']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:50:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b7e9771-afcc-4953-9591-a3d0950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:16:01.000Z",
|
|
"modified": "2018-08-23T11:16:01.000Z",
|
|
"description": "Address to download the parser payload",
|
|
"pattern": "[url:value = 'http://url.plus/Updates/tt/parser.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-23T11:16:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b7ea118-b9ec-4598-b96a-49b7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:57:44.000Z",
|
|
"modified": "2018-08-23T11:57:44.000Z",
|
|
"description": "After launch of skype_sync2.exe it downloads a codec for MP3 encoding directly from this address.",
|
|
"pattern": "[url:value = 'http://54.67.109.199/skype_resource/libmp3lame.dll']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-23T11:57:44Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b7ea243-31a0-4e2b-bb58-4fbe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T12:03:08.000Z",
|
|
"modified": "2018-08-23T12:03:08.000Z",
|
|
"description": "The skype_sync2.exe module has the following PDB string:",
|
|
"pattern": "[file:name = '\\\\\\\\vmware-host\\\\Shared Folders\\\\dati\\\\Backup\\\\Projects\\\\REcodin_2\\\\REcodin_2\\\\obj\\\\x86\\\\Release\\\\REcodin_2.pdb']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-23T12:03:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"filename\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a80-f2b8-475d-8b6d-4d87950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:28.000Z",
|
|
"modified": "2018-09-03T13:43:28.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/tre/internet/Configuratore_3.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a82-73ec-481e-b96e-4136950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:30.000Z",
|
|
"modified": "2018-09-03T13:43:30.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/tre/internet/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a86-ad44-4523-8f8a-49a7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:34.000Z",
|
|
"modified": "2018-09-03T13:43:34.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/appPro_AC.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a8a-a3cc-42f1-8c76-4b5a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:38.000Z",
|
|
"modified": "2018-09-03T13:43:38.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/190/configurazione/vodafone/smartphone/VODAFONE\\\\%20Configuratore\\\\%20v5_4_2.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a8f-57dc-43f8-87db-466b950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:43.000Z",
|
|
"modified": "2018-09-03T13:43:43.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/190/configurazione/vodafone/smartphone/index.html']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:43Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a93-9ca4-4dee-8a6d-4b53950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:47.000Z",
|
|
"modified": "2018-09-03T13:43:47.000Z",
|
|
"pattern": "[url:value = 'http://217.194.13.133/190/configurazione/vodafone/smartphone/Vodafone\\\\%20Configuratore.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a98-2cf4-4a25-a3a9-4d8d950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:52.000Z",
|
|
"modified": "2018-09-03T13:43:52.000Z",
|
|
"pattern": "[url:value = 'http://vodafoneinfinity.sytes.net/tim/internet/Configuratore_TIM.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3a9c-86d4-4eab-afab-46a4950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:43:56.000Z",
|
|
"modified": "2018-09-03T13:43:56.000Z",
|
|
"pattern": "[url:value = 'http://vodafoneinfinity.sytes.net/tim/internet/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:43:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3aa0-c450-4c78-a711-4162950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:00.000Z",
|
|
"modified": "2018-09-03T13:44:00.000Z",
|
|
"pattern": "[url:value = 'http://vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/VODAFONE\\\\%20Configuratore\\\\%20v5_4_2.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3aa5-59f8-40ba-bcfd-461a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:05.000Z",
|
|
"modified": "2018-09-03T13:44:05.000Z",
|
|
"pattern": "[url:value = 'http://vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3aa9-402c-476e-8a8f-41b7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:09.000Z",
|
|
"modified": "2018-09-03T13:44:09.000Z",
|
|
"pattern": "[url:value = 'http://windupdate.serveftp.com/wind/LTE/WIND\\\\%20Configuratore\\\\%20v5_4_2.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3aad-c6b0-4bf4-b585-46e3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:13.000Z",
|
|
"modified": "2018-09-03T13:44:13.000Z",
|
|
"pattern": "[url:value = 'http://windupdate.serveftp.com/wind/LTE/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3ab2-e240-442e-b612-4ac6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:18.000Z",
|
|
"modified": "2018-09-03T13:44:18.000Z",
|
|
"pattern": "[url:value = 'http://119.network/lte/Internet-TIM-4G-LTE.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3ab6-a73c-4f1d-982c-4590950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:22.000Z",
|
|
"modified": "2018-09-03T13:44:22.000Z",
|
|
"pattern": "[url:value = 'http://119.network/lte/download.html']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b8d3aba-54d0-4e0a-8721-42ce950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:44:26.000Z",
|
|
"modified": "2018-09-03T13:44:26.000Z",
|
|
"pattern": "[url:value = 'http://119.network/lte/Configuratore_TIM.apk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-03T13:44:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:14.000Z",
|
|
"modified": "2018-10-03T11:15:14.000Z",
|
|
"first_observed": "2018-10-03T11:15:14Z",
|
|
"last_observed": "2018-10-03T11:15:14Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"ipv4-addr--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4c2-13a4-458d-b7a8-45ffe387cbd9",
|
|
"value": "52.88.53.237"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:16.000Z",
|
|
"modified": "2018-10-03T11:15:16.000Z",
|
|
"first_observed": "2018-10-03T11:15:16Z",
|
|
"last_observed": "2018-10-03T11:15:16Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"ipv4-addr--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4c4-0e38-4d3e-94b5-4f8fe387cbd9",
|
|
"value": "184.168.221.13"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:17.000Z",
|
|
"modified": "2018-10-03T11:15:17.000Z",
|
|
"first_observed": "2018-10-03T11:15:17Z",
|
|
"last_observed": "2018-10-03T11:15:17Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"ipv4-addr--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4c5-0a94-411e-9ae8-4f03e387cbd9",
|
|
"value": "184.168.221.21"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:21.000Z",
|
|
"modified": "2018-10-03T11:15:21.000Z",
|
|
"first_observed": "2018-10-03T11:15:21Z",
|
|
"last_observed": "2018-10-03T11:15:21Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"ipv4-addr--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4c9-5554-4bab-9ae0-4fbbe387cbd9",
|
|
"value": "184.168.221.12"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:22.000Z",
|
|
"modified": "2018-10-03T11:15:22.000Z",
|
|
"first_observed": "2018-10-03T11:15:22Z",
|
|
"last_observed": "2018-10-03T11:15:22Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"ipv4-addr--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4ca-fe88-4bac-b21e-4a3ee387cbd9",
|
|
"value": "208.109.232.108"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:23.000Z",
|
|
"modified": "2018-10-03T11:15:23.000Z",
|
|
"first_observed": "2018-10-03T11:15:23Z",
|
|
"last_observed": "2018-10-03T11:15:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"ipv4-addr--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4cb-d184-49ea-a5c8-42fae387cbd9",
|
|
"value": "184.168.221.61"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:23.000Z",
|
|
"modified": "2018-10-03T11:15:23.000Z",
|
|
"first_observed": "2018-10-03T11:15:23Z",
|
|
"last_observed": "2018-10-03T11:15:23Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"ipv4-addr--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4cb-ceb0-47d2-a406-4886e387cbd9",
|
|
"value": "50.63.202.56"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:24.000Z",
|
|
"modified": "2018-10-03T11:15:24.000Z",
|
|
"first_observed": "2018-10-03T11:15:24Z",
|
|
"last_observed": "2018-10-03T11:15:24Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"ipv4-addr--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4cc-c0d0-453d-ab9e-4ccde387cbd9",
|
|
"value": "184.168.221.23"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:15:25.000Z",
|
|
"modified": "2018-10-03T11:15:25.000Z",
|
|
"first_observed": "2018-10-03T11:15:25Z",
|
|
"last_observed": "2018-10-03T11:15:25Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"network-traffic--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"ipv4-addr--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-src\"",
|
|
"misp:category=\"Network activity\""
|
|
]
|
|
},
|
|
{
|
|
"type": "network-traffic",
|
|
"spec_version": "2.1",
|
|
"id": "network-traffic--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"src_ref": "ipv4-addr--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"protocols": [
|
|
"tcp"
|
|
]
|
|
},
|
|
{
|
|
"type": "ipv4-addr",
|
|
"spec_version": "2.1",
|
|
"id": "ipv4-addr--5bb4a4cd-13f8-45ed-81a5-4fcee387cbd9",
|
|
"value": "144.217.82.94"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8b20-12a8-4910-aeae-57f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:54:56.000Z",
|
|
"modified": "2018-08-10T12:54:56.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '0bc28ac5f2cadd524e7f443e06ad2a2b' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:54:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8bac-aa38-4fd7-b277-7d0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T12:57:16.000Z",
|
|
"modified": "2018-08-10T12:57:16.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '39fca709b416d8da592de3a3f714dce8' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T12:57:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d8c99-441c-4305-9431-4a6f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:01:13.000Z",
|
|
"modified": "2018-08-10T13:01:13.000Z",
|
|
"description": "Android payload",
|
|
"pattern": "[file:hashes.MD5 = '6964866106c0a353a7b91b580933c5d6' AND file:name = 'update_reb.zip' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:01:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:32:29.000Z",
|
|
"modified": "2018-08-23T11:32:29.000Z",
|
|
"first_observed": "2018-08-23T11:32:29Z",
|
|
"last_observed": "2018-08-23T11:32:29Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"file--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"directory--5b7e9b4a-76d0-4f5e-9f37-fc04950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"False\""
|
|
]
|
|
},
|
|
{
|
|
"type": "file",
|
|
"spec_version": "2.1",
|
|
"id": "file--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"name": "system.exe",
|
|
"parent_directory_ref": "directory--5b7e9b4a-76d0-4f5e-9f37-fc04950d210f",
|
|
"x_misp_state": "Malicious"
|
|
},
|
|
{
|
|
"type": "directory",
|
|
"spec_version": "2.1",
|
|
"id": "directory--5b7e9b4a-76d0-4f5e-9f37-fc04950d210f",
|
|
"path": "%APPDATA%/myupd/aud/"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d923b-1720-4be7-a432-cc41950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:25:15.000Z",
|
|
"modified": "2018-08-10T13:25:15.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '70a937b2504b3ad6c623581424c7e53d' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:25:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d92d3-3150-429c-8aaa-b711950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:27:47.000Z",
|
|
"modified": "2018-08-10T13:27:47.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'c091489a82263899d02b363b289a37f6' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:27:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9322-cf1c-4259-bed4-a179950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:29:06.000Z",
|
|
"modified": "2018-08-10T13:29:06.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'e12b9af5df1c638ef5a099961ffbe344' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:29:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9345-e134-4ff7-ae7d-cd92950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:29:41.000Z",
|
|
"modified": "2018-08-10T13:29:41.000Z",
|
|
"pattern": "[file:hashes.MD5 = '708445b8d358c254e861effffd4f819b' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:29:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d93f0-8528-4aa3-b1ea-4666950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:32:32.000Z",
|
|
"modified": "2018-08-10T13:32:32.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '3f0e8a3ad9fab04377b8e9a57a26f972' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:32:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d942f-1c14-47ff-92c6-cc71950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:33:35.000Z",
|
|
"modified": "2018-08-10T13:33:35.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'd574d0049f797611589803643a8aa3c3' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:33:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9459-7168-46b5-b31c-cc71950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:34:17.000Z",
|
|
"modified": "2018-08-10T13:34:17.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '6414f4bfbdd08d70c40b107e86276dbb' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:34:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9480-6300-4946-a56c-cc54950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:34:56.000Z",
|
|
"modified": "2018-08-10T13:34:56.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '90f26adb324a8b36d2cafdd755aa1e61' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:34:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d94ae-15c4-4c52-a4b0-a1de950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:35:42.000Z",
|
|
"modified": "2018-08-10T13:35:42.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'a2a8e8ac6f5fa5801395252e11afb356' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:35:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d94fd-4258-4009-9aaf-cc71950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:37:01.000Z",
|
|
"modified": "2018-08-10T13:37:01.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'ce241b48377ca216d8f2017991c1cef0' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:37:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d952c-48a4-4f24-8b5f-7cfd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:37:48.000Z",
|
|
"modified": "2018-08-10T13:37:48.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '0be2b5394dafb76efc54bd6113ac8689' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:37:48Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d956a-4d40-426d-baaa-a197950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:38:50.000Z",
|
|
"modified": "2018-08-10T13:38:50.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'd99a3c4348c88cdfa59e90d1b3b94fc3' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:38:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9595-20e0-4fe6-add9-cc54950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T13:39:33.000Z",
|
|
"modified": "2018-08-10T13:39:33.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'a287a434a0d40833d3ebf5808950b858' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T13:39:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9b83-f57c-49d1-8d6e-cc8c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:08:42.000Z",
|
|
"modified": "2018-08-10T14:08:42.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '7e6cb66a3623258444639d1fc2fd533f' AND file:name = 'update_set.zip' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:08:42Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9c4f-7290-45f0-ac9e-cbf1950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:08:15.000Z",
|
|
"modified": "2018-08-10T14:08:15.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'd9c7349e807e0f12eaa67b2de522954f' AND file:name = 'update_set.zip' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:08:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9d0f-9fbc-47c4-b8ef-fc06950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:11:27.000Z",
|
|
"modified": "2018-08-10T14:11:27.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '2c21f61a8df19d07fd0f42b631151517' AND file:name = 'update_dev.zip' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:11:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9d6d-1848-48ca-8d1c-cd99950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:13:01.000Z",
|
|
"modified": "2018-08-10T14:13:01.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = '4f76bdfc40529984bf8e8a05d665cef8' AND file:name = 'parser.apk' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:13:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9e03-619c-4049-9557-7cfd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:15:31.000Z",
|
|
"modified": "2018-08-10T14:15:31.000Z",
|
|
"description": "Android",
|
|
"pattern": "[file:hashes.MD5 = 'e2d6f1263000086e3146d5b5a3b78038' AND file:name = 'startup.arm64-v8a.zip' AND file:name = 'startup.armeabi.zip' AND file:name = 'startup.armeabi-v7a.zip' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:15:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9e59-14a8-4925-a9c1-cc8c950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:19:46.000Z",
|
|
"modified": "2018-08-23T11:19:46.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = '55fb01048b6287eadcbd9a0f86d21adf' AND file:name = 'msconf.exe' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-23T11:19:46Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9e85-048c-4c1a-ace7-fc06950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:17:41.000Z",
|
|
"modified": "2018-08-10T14:17:41.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = 'f673bb1d519138ced7659484c0b66c5b' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:17:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9eae-1e14-48eb-95ae-e737950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:18:22.000Z",
|
|
"modified": "2018-08-10T14:18:22.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = 'd3baa45ed342fbc5a56d974d36d5f73f' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:18:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9ed4-4744-46d8-bf6b-cd92950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:19:00.000Z",
|
|
"modified": "2018-08-10T14:19:00.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = '395f9f87df728134b5e3c1ca4d48e9fa' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:19:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9ef9-33e0-49f8-afc4-a1dd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:19:37.000Z",
|
|
"modified": "2018-08-10T14:19:37.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = '16311b16fd48c1c87c6476a455093e7a' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:19:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b6d9f15-302c-4528-b5b7-e737950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:20:05.000Z",
|
|
"modified": "2018-08-10T14:20:05.000Z",
|
|
"description": "Windows",
|
|
"pattern": "[file:hashes.MD5 = '6bcc3559d7405f25ea403317353d905f' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-10T14:20:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:33:47.000Z",
|
|
"modified": "2018-08-23T11:33:47.000Z",
|
|
"first_observed": "2018-08-23T11:33:47Z",
|
|
"last_observed": "2018-08-23T11:33:47Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"file--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"directory--5b7e9b99-3d00-433e-b666-441e950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"False\""
|
|
]
|
|
},
|
|
{
|
|
"type": "file",
|
|
"spec_version": "2.1",
|
|
"id": "file--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"name": "update.exe",
|
|
"parent_directory_ref": "directory--5b7e9b99-3d00-433e-b666-441e950d210f",
|
|
"x_misp_state": "Malicious"
|
|
},
|
|
{
|
|
"type": "directory",
|
|
"spec_version": "2.1",
|
|
"id": "directory--5b7e9b99-3d00-433e-b666-441e950d210f",
|
|
"path": "%APPDATA%/myupd/txt/"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6da202-2654-49e0-93dd-a1dd950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-10T14:34:20.000Z",
|
|
"modified": "2018-08-10T14:34:20.000Z",
|
|
"first_observed": "2018-08-10T14:34:20Z",
|
|
"last_observed": "2018-08-10T14:34:20Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"file--5b6da202-2654-49e0-93dd-a1dd950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"False\""
|
|
]
|
|
},
|
|
{
|
|
"type": "file",
|
|
"spec_version": "2.1",
|
|
"id": "file--5b6da202-2654-49e0-93dd-a1dd950d210f",
|
|
"name": "network.exe",
|
|
"x_misp_state": "Malicious"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:34:50.000Z",
|
|
"modified": "2018-08-23T11:34:50.000Z",
|
|
"first_observed": "2018-08-23T11:34:50Z",
|
|
"last_observed": "2018-08-23T11:34:50Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"file--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"directory--5b7e9bd8-8ef0-40c5-b985-4835950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"False\""
|
|
]
|
|
},
|
|
{
|
|
"type": "file",
|
|
"spec_version": "2.1",
|
|
"id": "file--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"name": "wow.exe",
|
|
"parent_directory_ref": "directory--5b7e9bd8-8ef0-40c5-b985-4835950d210f",
|
|
"x_misp_state": "Malicious"
|
|
},
|
|
{
|
|
"type": "directory",
|
|
"spec_version": "2.1",
|
|
"id": "directory--5b7e9bd8-8ef0-40c5-b985-4835950d210f",
|
|
"path": "%APPDATA%/myupd/scr/"
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:25:51.000Z",
|
|
"modified": "2018-08-23T11:25:51.000Z",
|
|
"first_observed": "2018-08-23T11:25:51Z",
|
|
"last_observed": "2018-08-23T11:25:51Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"file--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"directory--5b7e99bd-a06c-44b8-85de-4dbd950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"False\""
|
|
]
|
|
},
|
|
{
|
|
"type": "file",
|
|
"spec_version": "2.1",
|
|
"id": "file--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"name": "msconf.exe",
|
|
"parent_directory_ref": "directory--5b7e99bd-a06c-44b8-85de-4dbd950d210f",
|
|
"x_misp_state": "Malicious"
|
|
},
|
|
{
|
|
"type": "directory",
|
|
"spec_version": "2.1",
|
|
"id": "directory--5b7e99bd-a06c-44b8-85de-4dbd950d210f",
|
|
"path": "%APPDATA%/myupd/gen/"
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5b7141f1-ca14-400c-879d-8bd7950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-10-03T11:18:33.000Z",
|
|
"modified": "2018-10-03T11:18:33.000Z",
|
|
"name": "CVE-2013-2094",
|
|
"description": "The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9 uses an incorrect integer data type, which allows local users to gain privileges via a crafted perf_event_open system call.",
|
|
"labels": [
|
|
"misp:name=\"vulnerability\"",
|
|
"misp:meta-category=\"vulnerability\"",
|
|
"misp:to_ids=\"False\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2013-2094"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://cve.circl.lu/cve/CVE-2013-2094"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8176cced706b5e5d15887584150764894e94e02f"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.centos.org/pipermail/centos-announce/2013-May/019729.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.centos.org/pipermail/centos-announce/2013-May/019733.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00008.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-05/msg00018.html"
|
|
}
|
|
],
|
|
"x_misp_cvss_score": "7.2",
|
|
"x_misp_modified": "2017-01-06T21:59:00",
|
|
"x_misp_published": "2013-05-14T16:55:00",
|
|
"x_misp_state": "Published",
|
|
"x_misp_vulnerable_configuration": "Linux Kernel 3.8.8\r\nLinux Kernel 3.8.4\r\nLinux Kernel 3.8.1\r\nLinux Kernel 3.8.0\r\nLinux Kernel 3.8.2"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5b7ea077-cfbc-4059-9ac0-4554950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-08-23T11:58:58.000Z",
|
|
"modified": "2018-08-23T11:58:58.000Z",
|
|
"description": "Main purpose of this module is to exfiltrate Skype call recordings. Written in .Net. ",
|
|
"pattern": "[file:hashes.MD5 = '6bcc3559d7405f25ea403317353d905f' AND file:name = 'skype_sync2.exe' AND file:parent_directory_ref.path = '\\\\%APPDATA\\\\%/myupd/skype/' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-08-23T11:58:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5b8d2e5e-fd90-47bd-941d-4e98950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T12:51:42.000Z",
|
|
"modified": "2018-09-03T12:51:42.000Z",
|
|
"name": "CVE-2013-2595",
|
|
"description": "The device-initialization functionality in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, enables MSM_CAM_IOCTL_SET_MEM_MAP_INFO ioctl calls for an unrestricted mmap interface, which allows attackers to gain privileges via a crafted application.",
|
|
"labels": [
|
|
"misp:name=\"vulnerability\"",
|
|
"misp:meta-category=\"vulnerability\"",
|
|
"misp:to_ids=\"False\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2013-2595"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://www.codeaurora.org/projects/security-advisories/uncontrolled-memory-mapping-camera-driver-cve-2013-2595"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://cve.circl.lu/cve/CVE-2013-2595"
|
|
}
|
|
],
|
|
"x_misp_cvss_score": "7.2",
|
|
"x_misp_cvss_string": "7.2 (as of 02-09-2014 - 14:41)",
|
|
"x_misp_modified": "2014-02-09T14:41:00",
|
|
"x_misp_published": "2014-08-31T06:55:00",
|
|
"x_misp_state": "Published"
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5b8d306d-ed34-4a9c-9350-49ca950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:00:29.000Z",
|
|
"modified": "2018-09-03T13:00:29.000Z",
|
|
"name": "CVE-2013-6282",
|
|
"description": "Linux Kernel < 3.4.5 - Local Root Exploit (ARM - Android 4.2.2 / 4.4) Local exploit for arm platform",
|
|
"labels": [
|
|
"misp:name=\"vulnerability\"",
|
|
"misp:meta-category=\"vulnerability\"",
|
|
"misp:to_ids=\"False\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2013-6282"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=8404663f81d212918ff85f493649a7991209fa04"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.codeaurora.org/projects/security-advisories/missing-access-checks-putusergetuser-kernel-api-cve-2013-6282"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.5.5"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.openwall.com/lists/oss-security/2013/11/14/11"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.securityfocus.com/bid/63734"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2067-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://github.com/torvalds/linux/commit/8404663f81d212918ff85f493649a7991209fa04"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://www.exploit-db.com/exploits/40975/"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://cve.circl.lu/cve/CVE-2013-6282"
|
|
}
|
|
],
|
|
"x_misp_cvss_score": "7.2",
|
|
"x_misp_cvss_string": "7.2 (as of 20-11-2013 - 10:35)",
|
|
"x_misp_modified": "2017-02-09T21:29:00",
|
|
"x_misp_published": "2013-11-20T08:19:00",
|
|
"x_misp_state": "Published",
|
|
"x_misp_summary": "The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the contents of arbitrary kernel memory locations via a crafted application, as exploited in the wild against Android devices in October and November 2013."
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5b8d34d9-a7ac-407e-8faf-4357950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:23:41.000Z",
|
|
"modified": "2018-09-03T13:23:41.000Z",
|
|
"name": "CVE-2014-3153",
|
|
"description": "The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.",
|
|
"labels": [
|
|
"misp:name=\"vulnerability\"",
|
|
"misp:meta-category=\"vulnerability\"",
|
|
"misp:to_ids=\"False\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2014-3153"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e9c243a5a6de0be8e584c604d353412584b592f8"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://linux.oracle.com/errata/ELSA-2014-0771.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://linux.oracle.com/errata/ELSA-2014-3037.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://linux.oracle.com/errata/ELSA-2014-3038.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://linux.oracle.com/errata/ELSA-2014-3039.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://openwall.com/lists/oss-security/2014/06/05/24"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://openwall.com/lists/oss-security/2014/06/06/20"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2014-0800.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.debian.org/security/2014/dsa-2949"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.exploit-db.com/exploits/35370"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.openwall.com/lists/oss-security/2014/06/05/22"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.securityfocus.com/bid/67906"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.securitytracker.com/id/1030451"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2237-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2240-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103626"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://cve.circl.lu/cve/CVE-2014-3153"
|
|
}
|
|
],
|
|
"x_misp_cvss_score": "7.2",
|
|
"x_misp_modified": "2017-12-28T21:29:00",
|
|
"x_misp_published": "2014-07-06T10:55:00",
|
|
"x_misp_state": "Published",
|
|
"x_misp_vulnerable_configuration": [
|
|
"Linux Kernel 3.14",
|
|
"Linux Kernel 3.14 release candidate 1 cpe:2.3:o:linux:linux_kernel:3.14:rc1",
|
|
"Linux Kernel 3.14 release candidate 2 cpe:2.3:o:linux:linux_kernel:3.14:rc2",
|
|
"Linux Kernel 3.14 release candidate 3 cpe:2.3:o:linux:linux_kernel:3.14:rc3",
|
|
"Linux Kernel 3.14 release candidate 4 cpe:2.3:o:linux:linux_kernel:3.14:rc4",
|
|
"Linux Kernel 3.14 release candidate 5 cpe:2.3:o:linux:linux_kernel:3.14:rc5",
|
|
"Linux Kernel 3.14 release candidate 6 cpe:2.3:o:linux:linux_kernel:3.14:rc6",
|
|
"Linux Kernel 3.14 release candidate 7 cpe:2.3:o:linux:linux_kernel:3.14:rc7",
|
|
"Linux Kernel 3.14 release candidate 8 cpe:2.3:o:linux:linux_kernel:3.14:rc8",
|
|
"Linux Kernel 3.14.1 cpe:2.3:o:linux:linux_kernel:3.14.1",
|
|
"Linux Kernel 3.14.2 cpe:2.3:o:linux:linux_kernel:3.14.2",
|
|
"Linux Kernel 3.14.3 cpe:2.3:o:linux:linux_kernel:3.14.3",
|
|
"Linux Kernel 3.14.4 cpe:2.3:o:linux:linux_kernel:3.14.4",
|
|
"Linux Kernel 3.14.5 cpe:2.3:o:linux:linux_kernel:3.14.5",
|
|
"RedHat Enterprise MRG 2.0 cpe:2.3:a:redhat:enterprise_mrg:2.0",
|
|
"Red Hat Enterprise Linux 6 cpe:2.3:o:redhat:enterprise_linux:6"
|
|
]
|
|
},
|
|
{
|
|
"type": "vulnerability",
|
|
"spec_version": "2.1",
|
|
"id": "vulnerability--5b8d38fc-abb0-4860-8182-73ee950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-03T13:37:00.000Z",
|
|
"modified": "2018-09-03T13:37:00.000Z",
|
|
"name": "CVE-2015-3636",
|
|
"description": "The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.",
|
|
"labels": [
|
|
"misp:name=\"vulnerability\"",
|
|
"misp:meta-category=\"vulnerability\"",
|
|
"misp:to_ids=\"False\""
|
|
],
|
|
"external_references": [
|
|
{
|
|
"source_name": "cve",
|
|
"external_id": "CVE-2015-3636"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a134f083e79fb4c3d0a925691e732c56911b4326"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157788.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/157897.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-May/158804.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-07/msg00023.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2015-1221.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2015-1534.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2015-1564.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2015-1583.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://rhn.redhat.com/errata/RHSA-2015-1643.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.debian.org/security/2015/dsa-3290"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.openwall.com/lists/oss-security/2015/05/02/5"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.securityfocus.com/bid/74450"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.securitytracker.com/id/1033186"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2631-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2632-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2633-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://www.ubuntu.com/usn/USN-2634-1"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218074"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "https://github.com/torvalds/linux/commit/a134f083e79fb4c3d0a925691e732c56911b4326"
|
|
},
|
|
{
|
|
"source_name": "url",
|
|
"url": "http://cve.circl.lu/cve/CVE-2015-3636"
|
|
}
|
|
],
|
|
"x_misp_cvss_score": "4.9",
|
|
"x_misp_cvss_string": "4.9 (as of 21-06-2016 - 15:09)",
|
|
"x_misp_modified": "2018-04-01T21:30:00",
|
|
"x_misp_published": "2015-05-08T21:59:00",
|
|
"x_misp_state": "Published",
|
|
"x_misp_vulnerable_configuration": [
|
|
"Linux Kernel 4.0.2 cpe:2.3:o:linux:linux_kernel:4.0.2",
|
|
"Debian Linux 7.0 cpe:2.3:o:debian:debian_linux:7.0",
|
|
"Red Hat Enterprise Linux 6 cpe:2.3:o:redhat:enterprise_linux:6",
|
|
"Canonical Ubuntu Linux 12.04 LTS cpe:2.3:o:canonical:ubuntu_linux:12.04:-:-:-:lts"
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--ef468365-addd-40d5-a24d-543722f12e93",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:47.000Z",
|
|
"modified": "2018-09-04T07:15:47.000Z",
|
|
"pattern": "[file:hashes.MD5 = '16311b16fd48c1c87c6476a455093e7a' AND file:hashes.SHA1 = 'b467ff02b2a3ed5c902a8e76316527ae79dd80fe' AND file:hashes.SHA256 = '5f567844bd0da47426d14426d8acbfefad6426c1139648969e3b0dd5352d3ed5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:15:47Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--68dc24db-7625-4d35-b6d3-c6fb1283bf18",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:46.000Z",
|
|
"modified": "2018-09-04T07:15:46.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-10T04:22:44",
|
|
"category": "Other",
|
|
"uuid": "2866c689-6723-4b41-90d7-9ca6b8550254"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/5f567844bd0da47426d14426d8acbfefad6426c1139648969e3b0dd5352d3ed5/analysis/1533874964/",
|
|
"category": "External analysis",
|
|
"uuid": "5fed8734-d371-4581-88cd-f6fd4e8d47a4"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "40/67",
|
|
"category": "Other",
|
|
"uuid": "e92dcd5e-0717-4da4-97fc-f503e9efb0a6"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6ccf462a-1c20-452a-be71-cfe9936ed3ba",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:50.000Z",
|
|
"modified": "2018-09-04T07:15:50.000Z",
|
|
"pattern": "[file:hashes.MD5 = '6964866106c0a353a7b91b580933c5d6' AND file:hashes.SHA1 = 'dbfcd7c45371a6bcbfe1e570b9fa4f0480c24796' AND file:hashes.SHA256 = '943e1c57294a3163fb77235122143c05919baad0b93cc74c52210b90c9d0d0c9']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:15:50Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d2f2004d-2309-4a22-99cd-031a09bde2f1",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:48.000Z",
|
|
"modified": "2018-09-04T07:15:48.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-07-18T23:58:40",
|
|
"category": "Other",
|
|
"uuid": "f5e87f4e-d258-4a0e-ad5c-45867585d02b"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/943e1c57294a3163fb77235122143c05919baad0b93cc74c52210b90c9d0d0c9/analysis/1531958320/",
|
|
"category": "External analysis",
|
|
"uuid": "a82685eb-fbba-4863-b744-6b35093d87d4"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "15/61",
|
|
"category": "Other",
|
|
"uuid": "457681d3-47a8-4c88-b363-e89ce44576bd"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--7d3abf61-6c8e-47c1-93eb-d9f5103a9d5e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:53.000Z",
|
|
"modified": "2018-09-04T07:15:53.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'f673bb1d519138ced7659484c0b66c5b' AND file:hashes.SHA1 = 'deec3985f31f5372ce314e581154450bb51037a3' AND file:hashes.SHA256 = '012966cc1b714531790dd3f5f6cc040b2232fea98b0dbe56a24b13ae72160be5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:15:53Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--b822f813-8192-409c-8ccc-27c368ce781a",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:52.000Z",
|
|
"modified": "2018-09-04T07:15:52.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-10T04:25:00",
|
|
"category": "Other",
|
|
"uuid": "faf32260-f5de-46e2-a4e6-3f38108b822f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/012966cc1b714531790dd3f5f6cc040b2232fea98b0dbe56a24b13ae72160be5/analysis/1533875100/",
|
|
"category": "External analysis",
|
|
"uuid": "af58aa64-2487-4d3c-9c28-b4e889a1bd73"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "39/68",
|
|
"category": "Other",
|
|
"uuid": "68eaf88d-92e3-4bd5-8784-d8ed85864f53"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--cacbd9c4-03d0-435d-ad3c-a31a568e8d8e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:56.000Z",
|
|
"modified": "2018-09-04T07:15:56.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd574d0049f797611589803643a8aa3c3' AND file:hashes.SHA1 = '6cd604721a280103938173420ff6164896ac51c9' AND file:hashes.SHA256 = 'f241af9ba7501e28974729c229b445ee709a7ef438448b6e9f88ff7ff7228cb2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:15:56Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--60d09241-1457-4f27-8c62-a010c19eeb21",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:55.000Z",
|
|
"modified": "2018-09-04T07:15:55.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-19T10:25:00",
|
|
"category": "Other",
|
|
"uuid": "c532b896-fa38-417d-b84d-34e261beca8c"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/f241af9ba7501e28974729c229b445ee709a7ef438448b6e9f88ff7ff7228cb2/analysis/1516357500/",
|
|
"category": "External analysis",
|
|
"uuid": "c387dc9e-3e90-48cd-9864-0b0816f6208c"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "26/60",
|
|
"category": "Other",
|
|
"uuid": "0217ee93-1f1c-46c9-b098-75007bc65581"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--93f7c2d4-3eda-4a19-aba6-b3bdb34be6c6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:59.000Z",
|
|
"modified": "2018-09-04T07:15:59.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a287a434a0d40833d3ebf5808950b858' AND file:hashes.SHA1 = '0068a8e61fe75213738ecf9ad4927cb7a533886b' AND file:hashes.SHA256 = 'bf20c17881ff3c4b0bf121cc56c6e79d2ce8ecb4c08cc719e5835e6c74f339a0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:15:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fa8c321e-5cde-45bb-a01c-7e2a2a09b969",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:15:57.000Z",
|
|
"modified": "2018-09-04T07:15:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-25T04:39:04",
|
|
"category": "Other",
|
|
"uuid": "6fcb1e6c-ec15-4884-88db-247a51dfc5b0"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/bf20c17881ff3c4b0bf121cc56c6e79d2ce8ecb4c08cc719e5835e6c74f339a0/analysis/1516855144/",
|
|
"category": "External analysis",
|
|
"uuid": "e0465689-cbe2-4691-bab3-95b3b960ec31"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "27/60",
|
|
"category": "Other",
|
|
"uuid": "76f4af1a-a82f-42e4-ac27-526c258e1f50"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6bf27c78-9d3b-4926-9c37-ec97cf90fee5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:01.000Z",
|
|
"modified": "2018-09-04T07:16:01.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'a2a8e8ac6f5fa5801395252e11afb356' AND file:hashes.SHA1 = '640b42bc0b054458631877c8de46028528e4ac3e' AND file:hashes.SHA256 = '91fa0d2414e029c042eb78d4f53010c3af161edb815e97a021c24f8a03033a07']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--22999236-217f-4117-ae67-135d962de74e",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:00.000Z",
|
|
"modified": "2018-09-04T07:16:00.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-07-04T09:04:20",
|
|
"category": "Other",
|
|
"uuid": "051f2ef5-b025-4238-9141-06d9400fe8d2"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/91fa0d2414e029c042eb78d4f53010c3af161edb815e97a021c24f8a03033a07/analysis/1530695060/",
|
|
"category": "External analysis",
|
|
"uuid": "731ed6fb-d0ab-4ebe-abf1-1795a4be554a"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "33/58",
|
|
"category": "Other",
|
|
"uuid": "be591f16-c971-48ba-bb88-67faee3866c8"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--a4995eaf-38d1-4aed-a189-061d8ad9eb5b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:04.000Z",
|
|
"modified": "2018-09-04T07:16:04.000Z",
|
|
"pattern": "[file:hashes.MD5 = '3f0e8a3ad9fab04377b8e9a57a26f972' AND file:hashes.SHA1 = '018085fac80c537ec80c292e2b10f48259d4764a' AND file:hashes.SHA256 = '2d087d89364b22d180a7e8e923a6dca5fd6d131dad12db9dd2a2ae5c4b9d9675']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--28a0ab9f-4372-42ba-bea6-9a437f2c55e6",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:02.000Z",
|
|
"modified": "2018-09-04T07:16:02.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-07-27T15:55:19",
|
|
"category": "Other",
|
|
"uuid": "1345557f-678e-446a-ad9e-ead4683b8e06"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/2d087d89364b22d180a7e8e923a6dca5fd6d131dad12db9dd2a2ae5c4b9d9675/analysis/1532706919/",
|
|
"category": "External analysis",
|
|
"uuid": "5ce5ac4b-a328-43de-9a26-772f3d643fe7"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "33/62",
|
|
"category": "Other",
|
|
"uuid": "181a8e99-3d23-4157-ac33-803c5fd7b2c6"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--19019d95-d653-45c4-a76a-e1d0514ea188",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:06.000Z",
|
|
"modified": "2018-09-04T07:16:06.000Z",
|
|
"pattern": "[file:hashes.MD5 = '70a937b2504b3ad6c623581424c7e53d' AND file:hashes.SHA1 = '23912d8a28324ae6c5fe5acd518045a2cf4d339f' AND file:hashes.SHA256 = '9722d16ec5d19edca0c6f53ba7d5ca2df650fd6892ed5c2a7b279b2299487b0a']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a6f536ba-7227-4404-a445-3859005c2d85",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:05.000Z",
|
|
"modified": "2018-09-04T07:16:05.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-07-02T19:56:42",
|
|
"category": "Other",
|
|
"uuid": "b857d04b-c991-4d6e-8b5c-66e76a7ee423"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/9722d16ec5d19edca0c6f53ba7d5ca2df650fd6892ed5c2a7b279b2299487b0a/analysis/1530561402/",
|
|
"category": "External analysis",
|
|
"uuid": "06527aee-c15a-45f2-8952-2a9ed26ae858"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "32/56",
|
|
"category": "Other",
|
|
"uuid": "bf5444cf-5f02-4ea6-af87-9a085f8fdde0"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--dddd50b2-9d97-476a-864e-021d7986d6fb",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:09.000Z",
|
|
"modified": "2018-09-04T07:16:09.000Z",
|
|
"pattern": "[file:hashes.MD5 = '6bcc3559d7405f25ea403317353d905f' AND file:hashes.SHA1 = '5e7a6a62db26fe16be4e0851d5801397d591bed6' AND file:hashes.SHA256 = 'c74108a74a9afd47eee894921784fd1ea26a80627afd2fe2103b388abafdc2cc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--497f5b93-ac74-4869-b34e-e18258a06405",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:07.000Z",
|
|
"modified": "2018-09-04T07:16:07.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-10T13:16:08",
|
|
"category": "Other",
|
|
"uuid": "0f6adb2c-3165-41f9-a980-917261bfebe1"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/c74108a74a9afd47eee894921784fd1ea26a80627afd2fe2103b388abafdc2cc/analysis/1533906968/",
|
|
"category": "External analysis",
|
|
"uuid": "75510a63-1046-43b6-8e41-66d6d4de0375"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "46/68",
|
|
"category": "Other",
|
|
"uuid": "4456fe6b-aff2-4621-9265-61ed1523a5ff"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f43d2055-c298-4014-b16c-cb31bb84171b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:11.000Z",
|
|
"modified": "2018-09-04T07:16:11.000Z",
|
|
"pattern": "[file:hashes.MD5 = '39fca709b416d8da592de3a3f714dce8' AND file:hashes.SHA1 = '90320997c7dac34d4261eb38eb548910efc2b983' AND file:hashes.SHA256 = 'e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f9620a5e-f529-47ca-b57b-52959ee91051",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:10.000Z",
|
|
"modified": "2018-09-04T07:16:10.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-18T09:47:32",
|
|
"category": "Other",
|
|
"uuid": "26e7365b-c650-4b23-9ac4-d76ed6016811"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c/analysis/1534585652/",
|
|
"category": "External analysis",
|
|
"uuid": "e63f2789-3b7b-421f-bff5-dbc2cc417ab5"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/62",
|
|
"category": "Other",
|
|
"uuid": "104d1f87-4293-4bf5-85f7-9dcb05ddcbd4"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--aa457e4c-9f49-4f78-84ec-5d60a7c157a2",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:14.000Z",
|
|
"modified": "2018-09-04T07:16:14.000Z",
|
|
"pattern": "[file:hashes.MD5 = '708445b8d358c254e861effffd4f819b' AND file:hashes.SHA1 = 'd190b480942ac732f282c61a540e9138a3e764b5' AND file:hashes.SHA256 = 'af848999a4b8df0e33f5a05a618c83d1f3052d4026ab77b2acf66def71df754e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--8af76320-edcc-4b95-bdbd-bf638bd1e369",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:12.000Z",
|
|
"modified": "2018-09-04T07:16:12.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-25T12:52:29",
|
|
"category": "Other",
|
|
"uuid": "76c45898-d592-4b3b-98f7-f21727ec10d7"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/af848999a4b8df0e33f5a05a618c83d1f3052d4026ab77b2acf66def71df754e/analysis/1535201549/",
|
|
"category": "External analysis",
|
|
"uuid": "8da17835-8e60-4ffa-92b6-7da88f623d95"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "25/60",
|
|
"category": "Other",
|
|
"uuid": "d782b423-3f90-48ee-8600-3b6502d59692"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--790fef27-93cc-4a9f-803a-b320db0dee95",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:16.000Z",
|
|
"modified": "2018-09-04T07:16:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd9c7349e807e0f12eaa67b2de522954f' AND file:hashes.SHA1 = '5f37de1ced07e35444ce4ea015084b92bc1baabf' AND file:hashes.SHA256 = '255be8e830c9b43928b11a8e1b531a94826d30919e7f739a5ed07141d6a70bb7']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f234144d-1765-4cf4-b8ad-6d6f1a2b6472",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:15.000Z",
|
|
"modified": "2018-09-04T07:16:15.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-07-19T00:11:55",
|
|
"category": "Other",
|
|
"uuid": "88e2183e-9edb-463f-ae3c-a86be7e7ae59"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/255be8e830c9b43928b11a8e1b531a94826d30919e7f739a5ed07141d6a70bb7/analysis/1531959115/",
|
|
"category": "External analysis",
|
|
"uuid": "f0445432-dab0-46e8-a8f5-455d9a6645d3"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "31/61",
|
|
"category": "Other",
|
|
"uuid": "a030e69a-a20f-475f-b2c1-066595ff0684"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6ff856c9-fa6e-454c-ba8c-0fc21d5cc864",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:19.000Z",
|
|
"modified": "2018-09-04T07:16:19.000Z",
|
|
"pattern": "[file:hashes.MD5 = '395f9f87df728134b5e3c1ca4d48e9fa' AND file:hashes.SHA1 = 'ab0debc27d171ac15a235910847faee6ae1f053d' AND file:hashes.SHA256 = '48477ffcc2cf57e34fbc45599efa830620dc18139dbbb8dfe59d56fd87728b25']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--41755892-e078-4a46-87e8-1f5e2677e25c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:17.000Z",
|
|
"modified": "2018-09-04T07:16:17.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-10T04:37:28",
|
|
"category": "Other",
|
|
"uuid": "40fcc649-7ce9-4874-a2a6-98fb47cab457"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/48477ffcc2cf57e34fbc45599efa830620dc18139dbbb8dfe59d56fd87728b25/analysis/1533875848/",
|
|
"category": "External analysis",
|
|
"uuid": "1ab545b6-d270-4a3c-bc5d-95dcd354c48f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "43/68",
|
|
"category": "Other",
|
|
"uuid": "f4ed9f04-016d-486c-8992-a3d99bce65b5"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--09391239-3536-4168-8f87-72ae9d533bef",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:21.000Z",
|
|
"modified": "2018-09-04T07:16:21.000Z",
|
|
"pattern": "[file:hashes.MD5 = '0bc28ac5f2cadd524e7f443e06ad2a2b' AND file:hashes.SHA1 = '13c2cf52c2d97c50b5d10300911e15b52a9f5bc4' AND file:hashes.SHA256 = 'accd05c00951ef568594efebd5c30bdce2e63cee9b2cdd88cb705776e0a4ca70']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d85d218a-03c1-40d8-9b3f-b88bb3f6e132",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:20.000Z",
|
|
"modified": "2018-09-04T07:16:20.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-24T10:54:09",
|
|
"category": "Other",
|
|
"uuid": "96807bd6-ba7b-436f-a02b-a2173383a39a"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/accd05c00951ef568594efebd5c30bdce2e63cee9b2cdd88cb705776e0a4ca70/analysis/1516791249/",
|
|
"category": "External analysis",
|
|
"uuid": "b2059571-77ea-48f7-8cb2-6f05e670e267"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "27/60",
|
|
"category": "Other",
|
|
"uuid": "63871844-c633-4cb4-a641-c2ecd075c6e6"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--bd4d9903-64a2-48b5-9aca-8daaf2bcc0ee",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:24.000Z",
|
|
"modified": "2018-09-04T07:16:24.000Z",
|
|
"pattern": "[file:hashes.MD5 = '7e6cb66a3623258444639d1fc2fd533f' AND file:hashes.SHA1 = '79741484c3c59e6b15b14be4853128edb7fd2f4a' AND file:hashes.SHA256 = 'e9722d22967068c74f4c149c29bc4988d6178dda7b15fd72f488bbefed4faf28']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--57bf09f8-10dd-40e1-b635-be7748f76773",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:22.000Z",
|
|
"modified": "2018-09-04T07:16:22.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-01-17T07:52:11",
|
|
"category": "Other",
|
|
"uuid": "b3ea6da3-525d-4014-83f7-b0b4e482b79e"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/e9722d22967068c74f4c149c29bc4988d6178dda7b15fd72f488bbefed4faf28/analysis/1516175531/",
|
|
"category": "External analysis",
|
|
"uuid": "439ccd4e-59c1-49ff-8d89-5c34f9bb064b"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "15/60",
|
|
"category": "Other",
|
|
"uuid": "c30149ef-276a-48cc-8e0b-c497bd7a2f62"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--1e7e2181-e880-4274-9ddf-f8daa44549c7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:26.000Z",
|
|
"modified": "2018-09-04T07:16:26.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd3baa45ed342fbc5a56d974d36d5f73f' AND file:hashes.SHA1 = '54f88d82f3468bde37abeb6c209348401de02999' AND file:hashes.SHA256 = '74b1d9c27313dd8a266bf3011896cc9673653a84c2475bed483fa72a1dfb9361']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--084b441e-ce8b-4086-ad6c-0ef1e2b2c78b",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:25.000Z",
|
|
"modified": "2018-09-04T07:16:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-10T04:42:30",
|
|
"category": "Other",
|
|
"uuid": "f16ae11a-12b4-4626-b5ac-96166c0d8f99"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/74b1d9c27313dd8a266bf3011896cc9673653a84c2475bed483fa72a1dfb9361/analysis/1533876150/",
|
|
"category": "External analysis",
|
|
"uuid": "b30e9b63-6c0d-4eb2-a712-2c27f8886e82"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "38/68",
|
|
"category": "Other",
|
|
"uuid": "1856e87d-a719-48f9-9c0b-d57b633eb969"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--43892c3f-9a1b-466c-9bee-8e397cfe7d99",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"pattern": "[file:hashes.MD5 = '55fb01048b6287eadcbd9a0f86d21adf' AND file:hashes.SHA1 = 'd7e22fdecd2cc533852b5a662039dfcb99a13487' AND file:hashes.SHA256 = '7a35a20bb3fc5d879b99a71d9c5c5475752b900a3082aa5c4f2d6d23aa78dee2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-09-04T07:16:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--d57f6827-03ab-40da-9465-a87640bda410",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-09-04T07:16:27.000Z",
|
|
"modified": "2018-09-04T07:16:27.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-08-29T00:19:01",
|
|
"category": "Other",
|
|
"uuid": "3183fed9-2981-4063-9f5e-78d811d9b601"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7a35a20bb3fc5d879b99a71d9c5c5475752b900a3082aa5c4f2d6d23aa78dee2/analysis/1535501941/",
|
|
"category": "External analysis",
|
|
"uuid": "23b507c2-0f42-4e17-b3dc-90ceaeb84866"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "40/67",
|
|
"category": "Other",
|
|
"uuid": "f2cf6afa-89ee-4cac-9353-eb7c910b3948"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7ff1f83d-e138-4575-9d54-4b8c2b16b428",
|
|
"created": "2018-08-10T13:20:40.000Z",
|
|
"modified": "2018-08-10T13:20:40.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6d908d-7b7c-48a2-9f5d-cc41950d210f",
|
|
"target_ref": "indicator--5b6d90f1-3bf4-4746-a265-4d62950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--4f7ca7c8-da7c-4ca0-b995-d776223c2a4c",
|
|
"created": "2018-08-10T14:30:01.000Z",
|
|
"modified": "2018-08-10T14:30:01.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"target_ref": "indicator--5b6d9fab-3cf0-4839-8421-cc8c950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--efee5afc-d453-436e-a7dd-725a0903206a",
|
|
"created": "2018-08-10T14:31:16.000Z",
|
|
"modified": "2018-08-10T14:31:16.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6da0bc-5908-45f0-a3cb-7d2f950d210f",
|
|
"target_ref": "indicator--5b6da192-aa4c-4141-9993-b712950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--ee173b9a-d87f-4cf5-914c-aedb9e565cd2",
|
|
"created": "2018-08-10T14:34:17.000Z",
|
|
"modified": "2018-08-10T14:34:17.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6da202-2654-49e0-93dd-a1dd950d210f",
|
|
"target_ref": "indicator--5b6da23b-5980-40d9-b40e-fc18950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--a07bca2b-2a1d-4827-a673-057ae7bc39a8",
|
|
"created": "2018-08-10T14:36:20.000Z",
|
|
"modified": "2018-08-10T14:36:20.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6da2a2-b7e0-4bec-ac25-7d2f950d210f",
|
|
"target_ref": "indicator--5b6da2c9-e668-4985-a4c1-a1dd950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--dbe48377-59a3-4247-b765-2104c59785f5",
|
|
"created": "2018-08-10T14:38:58.000Z",
|
|
"modified": "2018-08-10T14:38:58.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "observed-data--5b6da326-0c08-44a0-90be-fc18950d210f",
|
|
"target_ref": "indicator--5b6da343-5348-45c3-88f4-4756950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--11d0bf8a-0461-4dc4-b0a4-7e1a92b3ff33",
|
|
"created": "2018-08-23T11:58:55.000Z",
|
|
"modified": "2018-08-23T11:58:55.000Z",
|
|
"relationship_type": "related-to",
|
|
"source_ref": "indicator--5b7ea077-cfbc-4059-9ac0-4554950d210f",
|
|
"target_ref": "indicator--5b7ea118-b9ec-4598-b96a-49b7950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f00740af-0b9e-4a38-bc3d-6ee875911ae2",
|
|
"created": "2018-09-04T07:16:28.000Z",
|
|
"modified": "2018-09-04T07:16:28.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--ef468365-addd-40d5-a24d-543722f12e93",
|
|
"target_ref": "x-misp-object--68dc24db-7625-4d35-b6d3-c6fb1283bf18"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--14e218b6-19c1-436a-9566-e2544ca12946",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6ccf462a-1c20-452a-be71-cfe9936ed3ba",
|
|
"target_ref": "x-misp-object--d2f2004d-2309-4a22-99cd-031a09bde2f1"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b4791049-89b2-4497-9b06-c03d9c6d8e3a",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--7d3abf61-6c8e-47c1-93eb-d9f5103a9d5e",
|
|
"target_ref": "x-misp-object--b822f813-8192-409c-8ccc-27c368ce781a"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--51e0d8fa-26cc-44ff-be5c-5e168ce8a701",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--cacbd9c4-03d0-435d-ad3c-a31a568e8d8e",
|
|
"target_ref": "x-misp-object--60d09241-1457-4f27-8c62-a010c19eeb21"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--80759dc6-6d60-462b-bc88-e3b4f0213699",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--93f7c2d4-3eda-4a19-aba6-b3bdb34be6c6",
|
|
"target_ref": "x-misp-object--fa8c321e-5cde-45bb-a01c-7e2a2a09b969"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8f552d0f-e23b-43fa-a880-848eda1feee5",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6bf27c78-9d3b-4926-9c37-ec97cf90fee5",
|
|
"target_ref": "x-misp-object--22999236-217f-4117-ae67-135d962de74e"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--71b19f2e-ec2a-44d6-9332-9886502e6440",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--a4995eaf-38d1-4aed-a189-061d8ad9eb5b",
|
|
"target_ref": "x-misp-object--28a0ab9f-4372-42ba-bea6-9a437f2c55e6"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--105a692b-088c-47a3-b854-13f7b9eeab3b",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--19019d95-d653-45c4-a76a-e1d0514ea188",
|
|
"target_ref": "x-misp-object--a6f536ba-7227-4404-a445-3859005c2d85"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d862dd3b-0a86-431d-8801-52143abb6198",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--dddd50b2-9d97-476a-864e-021d7986d6fb",
|
|
"target_ref": "x-misp-object--497f5b93-ac74-4869-b34e-e18258a06405"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--02d08b30-f1b2-4d3e-939a-e72e65aa02c0",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--f43d2055-c298-4014-b16c-cb31bb84171b",
|
|
"target_ref": "x-misp-object--f9620a5e-f529-47ca-b57b-52959ee91051"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--9a1184df-617a-43be-b140-6d4a4c2d6dd9",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--aa457e4c-9f49-4f78-84ec-5d60a7c157a2",
|
|
"target_ref": "x-misp-object--8af76320-edcc-4b95-bdbd-bf638bd1e369"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--56e6c00d-e1fc-4cab-b092-d05bfcbf29d2",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--790fef27-93cc-4a9f-803a-b320db0dee95",
|
|
"target_ref": "x-misp-object--f234144d-1765-4cf4-b8ad-6d6f1a2b6472"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6c007664-1714-41cb-832f-02e3632fe85a",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--6ff856c9-fa6e-454c-ba8c-0fc21d5cc864",
|
|
"target_ref": "x-misp-object--41755892-e078-4a46-87e8-1f5e2677e25c"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f40ba5b5-3cd1-434c-8f2d-af072f02f9b1",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--09391239-3536-4168-8f87-72ae9d533bef",
|
|
"target_ref": "x-misp-object--d85d218a-03c1-40d8-9b3f-b88bb3f6e132"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--39dcf14c-d6ff-4617-b305-1ff152c23976",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--bd4d9903-64a2-48b5-9aca-8daaf2bcc0ee",
|
|
"target_ref": "x-misp-object--57bf09f8-10dd-40e1-b635-be7748f76773"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--fd3fe726-19ad-49f7-aa11-511a11d18d6b",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--1e7e2181-e880-4274-9ddf-f8daa44549c7",
|
|
"target_ref": "x-misp-object--084b441e-ce8b-4086-ad6c-0ef1e2b2c78b"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--d266e507-907e-4a72-b713-69b81f0b8a3c",
|
|
"created": "2018-09-04T07:16:29.000Z",
|
|
"modified": "2018-09-04T07:16:29.000Z",
|
|
"relationship_type": "analysed-with",
|
|
"source_ref": "indicator--43892c3f-9a1b-466c-9bee-8e397cfe7d99",
|
|
"target_ref": "x-misp-object--d57f6827-03ab-40da-9465-a87640bda410"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |