adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/misp/be8c3307-4b09-4ddf-af24-41c2385d8036.json

387 lines
No EOL
16 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--be8c3307-4b09-4ddf-af24-41c2385d8036",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T08:40:12.000Z",
"modified": "2022-08-31T08:40:12.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--be8c3307-4b09-4ddf-af24-41c2385d8036",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T08:40:12.000Z",
"modified": "2022-08-31T08:40:12.000Z",
"name": "Remcos RAT New TTPS \u2013 Detection & Response",
"published": "2022-10-24T13:56:05Z",
"object_refs": [
"indicator--df994929-4233-49d8-8ee1-fe74efa43e04",
"indicator--9968fbe6-da06-43b8-a264-f972a350bc74",
"indicator--3276f7e4-03a3-4c09-9d4d-e8a0dcd39e05",
"indicator--5510130e-924e-4efc-9b33-76ac8c0b5495",
"indicator--54ec8646-3bba-4695-85be-3399b0294058",
"indicator--da77edf5-854d-4a5c-ae31-cdc72e63c2ab",
"indicator--0116dee7-8bb3-44d5-89ee-0e48099ec265",
"indicator--e47a293f-bb9c-486d-8d1d-1ababb321a9e",
"indicator--43213f12-3d3d-4e84-9304-ad3e97814c35",
"indicator--ca123a03-e340-441a-aa28-ab5fd1284558",
"indicator--2eb72bd3-77a7-4040-aae7-2879896ca54e",
"indicator--640fee1c-2637-4c90-bf25-ef1563fcca05",
"x-misp-object--53d47357-bc5c-4c53-b3d5-fca18380b817",
"x-misp-object--06ec68ed-5627-4d27-b9c0-3fe3e0b9e50a"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"misp-galaxy:malpedia=\"Remcos\"",
"misp-galaxy:mitre-tool=\"Remcos - S0332\"",
"misp-galaxy:rat=\"Remcos\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--df994929-4233-49d8-8ee1-fe74efa43e04",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:02.000Z",
"modified": "2022-08-31T07:13:02.000Z",
"pattern": "[file:hashes.MD5 = '6d25e04e66cccb61648f34728af7c2f2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9968fbe6-da06-43b8-a264-f972a350bc74",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:02.000Z",
"modified": "2022-08-31T07:13:02.000Z",
"pattern": "[file:hashes.MD5 = 'f331c18c3f685d245d40911d3bd20519']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3276f7e4-03a3-4c09-9d4d-e8a0dcd39e05",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:02.000Z",
"modified": "2022-08-31T07:13:02.000Z",
"pattern": "[file:hashes.MD5 = '8cea687c5c02c9b71303c53dc2641f03']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:02Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"md5\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5510130e-924e-4efc-9b33-76ac8c0b5495",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:17.000Z",
"modified": "2022-08-31T07:13:17.000Z",
"pattern": "[url:value = 'http://geoplugin.net/json.gp']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--54ec8646-3bba-4695-85be-3399b0294058",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:17.000Z",
"modified": "2022-08-31T07:13:17.000Z",
"pattern": "[domain-name:value = 'falimore001.hopto.org']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"hostname\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--da77edf5-854d-4a5c-ae31-cdc72e63c2ab",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:17.000Z",
"modified": "2022-08-31T07:13:17.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.237.33.50']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--0116dee7-8bb3-44d5-89ee-0e48099ec265",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:13:17.000Z",
"modified": "2022-08-31T07:13:17.000Z",
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '194.147.140.29']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:13:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"ip-dst\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e47a293f-bb9c-486d-8d1d-1ababb321a9e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:14:48.000Z",
"modified": "2022-08-31T07:14:48.000Z",
"pattern": "[file:hashes.SHA256 = 'bf7212910de7bff455c3b3fe4b3a1a05059fe0da0c29e69b3aef492fe2a66fc0']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:14:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--43213f12-3d3d-4e84-9304-ad3e97814c35",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:14:48.000Z",
"modified": "2022-08-31T07:14:48.000Z",
"pattern": "[file:hashes.SHA256 = 'af9596cf630f0f3e6e453ac8bdd6671f84feb65a057483ec5f620d04f4068209']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:14:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ca123a03-e340-441a-aa28-ab5fd1284558",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T07:14:48.000Z",
"modified": "2022-08-31T07:14:48.000Z",
"pattern": "[file:hashes.SHA256 = 'e2816883a7a514fe1a3fbce95c04c2fc735f0c7ab872f7c23978388c42aea5c2']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T07:14:48Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--2eb72bd3-77a7-4040-aae7-2879896ca54e",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T08:40:12.000Z",
"modified": "2022-08-31T08:40:12.000Z",
"pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\vbc.exe']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T08:40:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--640fee1c-2637-4c90-bf25-ef1563fcca05",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-31T08:40:12.000Z",
"modified": "2022-08-31T08:40:12.000Z",
"pattern": "[file:name = '\\\\%WINDIR\\\\%\\\\Microsoft.NET\\\\Framework64\\\\v4.0.30319\\\\vbc.exe.config']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2022-08-31T08:40:12Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"filename\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--53d47357-bc5c-4c53-b3d5-fca18380b817",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-30T12:42:47.000Z",
"modified": "2022-08-30T12:42:47.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://www.socinvestigation.com/remcos-rat-new-ttps-detection-response/",
"category": "External analysis",
"uuid": "7bbed825-6ab9-4612-887e-1623b04429bb"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--06ec68ed-5627-4d27-b9c0-3fe3e0b9e50a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2022-08-30T14:03:29.000Z",
"modified": "2022-08-30T14:03:29.000Z",
"labels": [
"misp:name=\"report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "link",
"value": "https://otx.alienvault.com/pulse/630cbb6eb1975f82211a702f",
"category": "External analysis",
"uuid": "c51bbd6b-ba7a-4370-97fb-09972c3b3b0d"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "report"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink