adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/6b6fa46d-4a17-44a4-a234-d69487b04597.json

270 lines
No EOL
25 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--6b6fa46d-4a17-44a4-a234-d69487b04597",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-25T06:23:39.000Z",
"modified": "2023-08-25T06:23:39.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--6b6fa46d-4a17-44a4-a234-d69487b04597",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-25T06:23:39.000Z",
"modified": "2023-08-25T06:23:39.000Z",
"name": "CISA - MAR-10459736.r1.v1 - WHIRLPOOL Variant",
"published": "2023-08-25T06:23:46Z",
"object_refs": [
"indicator--3e5f8fc0-da1f-47f0-8b6e-f4c4b033ce47",
"identity--8e112e72-aa8f-4190-a359-28a9abae2896",
"x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
"indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
"x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae",
"indicator--31532fc0-d3ee-479f-8482-a4d49732d5af",
"x-misp-object--74888f9e-4968-4601-944d-100a179c1b88",
"relationship--00012474-a0e7-4d07-b4f7-2a507fd15a15",
"relationship--5905796b-7a63-42a2-a5b8-82ced29c030b"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"tlp:clear"
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3e5f8fc0-da1f-47f0-8b6e-f4c4b033ce47",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-09T21:12:59.000Z",
"modified": "2023-08-09T21:12:59.000Z",
"description": "The file 'ssld' is a Linux ELF reverse shell and is a variant of WHIRLPOOL malware used on the Barracuda Email Security Gateway (ESG) device (Figure 1). The file looks for an encoded string with a '.io' extension (Figure 2). The string will be decoded and the data will be passed as the C2 which will include the Internet Protocol (IP) address and port number used to establish a reverse shell.",
"pattern": "['namespace'='CISA_Consolidated.yara' rule_name=CISA_10452108_02 rule_content=rule CISA_10452108_02 : WHIRLPOOL backdoor communicates_with_c2 installs_other_components\n{\n\tmeta:\n\t\tAuthor = \"CISA Code & Media Analysis\"\n\t\tIncident = \"10452108\"\n\t\tDate = \"2023-06-20\"\n\t\tLast_Modified = \"20230804_1730\"\n\t\tActor = \"n/a\"\n\t\tFamily = \"WHIRLPOOL\"\n\t\tCapabilities = \"communicates-with-c2 installs-other-components\"\n\t\tMalware_Type = \"backdoor\"\n\t\tTool_Type = \"unknown\"\n\t\tDescription = \"Detects malicious Linux WHIRLPOOL samples\"\n\t\tSHA256_1 = \"83ca636253fd1eb898b244855838e2281f257bbe8ead428b69528fc50b60ae9c\"\n\t\tSHA256_2 = \"8849a3273e0362c45b4928375d196714224ec22cb1d2df5d029bf57349860347\"\n\tstrings:\n\t\t$s0 = { 65 72 72 6f 72 20 2d 31 20 65 78 69 74 }\n\t\t$s1 = { 63 72 65 61 74 65 20 73 6f 63 6b 65 74 20 65 72 72 6f 72 3a 20 25 73 28 65 72 72 6f 72 3a 20 25 64 29 }\n\t\t$s2 = { c7 00 20 32 3e 26 66 c7 40 04 31 00 }\n\t\t$a3 = { 70 6c 61 69 6e 5f 63 6f 6e 6e 65 63 74 }\n\t\t$a4 = { 63 6f 6e 6e 65 63 74 20 65 72 72 6f 72 3a 20 25 73 28 65 72 72 6f 72 3a 20 25 64 29 }\n\t\t$a5 = { 73 73 6c 5f 63 6f 6e 6e 65 63 74 }\n\tcondition:\n\t\tuint32(0) == 0x464c457f and 4 of them\n}]",
"pattern_type": "yara",
"pattern_version": "2.1",
"valid_from": "2023-08-17T19:19:43.944668Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"yara\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--8e112e72-aa8f-4190-a359-28a9abae2896",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-04-12T17:53:09.000Z",
"modified": "2023-04-12T17:53:09.000Z",
"name": "GeminiProduction_CMA",
"description": "Cybersecurity and Infrastructure Security Agency Production Identity. Code and Media Analysis.",
"identity_class": "system",
"labels": [
"misp:name=\"identity\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"False\"",
"misp:confidence-level=\"completely-confident\""
],
"confidence": 100
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-09T21:12:59.000Z",
"modified": "2023-08-09T21:12:59.000Z",
"labels": [
"misp:name=\"malware-analysis\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "text",
"object_relation": "product",
"value": "eset",
"category": "Other",
"uuid": "42e406d8-bcb1-468d-b9d1-195810672cab"
},
{
"type": "text",
"object_relation": "result",
"value": "unknown",
"category": "Other",
"uuid": "aea648ae-f790-412a-8511-22728becdb95"
},
{
"type": "text",
"object_relation": "result_name",
"value": "a variant of Linux/WhirlPool.A trojan",
"category": "Other",
"uuid": "e2f4500e-7dea-4009-8c50-d8915623816a"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "malware-analysis"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-09T21:12:59.000Z",
"modified": "2023-08-09T21:12:59.000Z",
"pattern": "[file:hashes.MD5 = '77e1e9bf69b09ed0840534adb8258540' AND file:hashes.SHA1 = 'deadca9bd85ee5c4e086fd81eee09407b769e9b6' AND file:hashes.SHA256 = '0af253e60456b03af49cc675f71d47b2dd9a48f50a927e43b9d8116985c06459' AND file:hashes.SHA512 = '3ad6bd00c4195c9b1757a9d697196e8beffb343c331509c2eda24bbbd009cc1af552a1900ab04d169a22d273e6359cb2ff149050a7f792b9630108a4af226e2d' AND file:hashes.SSDEEP = '98304:1z2EGoxipg0NPbuqbVxbNgqE+Q+F4YGZLx4BAFm/CyU:LLXYGNFLj' AND file:name = 'ssld' AND file:size = '5034648']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-09T21:12:59Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-09T21:12:59.000Z",
"modified": "2023-08-09T21:12:59.000Z",
"labels": [
"misp:name=\"malware\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "text",
"object_relation": "description",
"value": "The file 'ssld' is a Linux ELF reverse shell and is a variant of WHIRLPOOL malware used on the Barracuda Email Security Gateway (ESG) device (Figure 1). The file looks for an encoded string with a '.io' extension (Figure 2). The string will be decoded and the data will be passed as the C2 which will include the Internet Protocol (IP) address and port number used to establish a reverse shell.",
"category": "Other",
"uuid": "2d538923-b375-4471-b5f4-69f653cf572e"
},
{
"type": "boolean",
"object_relation": "is_family",
"value": "0",
"category": "Other",
"uuid": "2b74c868-0c2e-4e1f-bb81-7cf1cc9d2c0b"
},
{
"type": "text",
"object_relation": "malware_type",
"value": "trojan",
"category": "Other",
"uuid": "be1cbecb-8dd5-4cf9-899f-a58169012721"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "malware"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--31532fc0-d3ee-479f-8482-a4d49732d5af",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-09T21:12:59.000Z",
"modified": "2023-08-09T21:12:59.000Z",
"pattern": "[file:hashes.MD5 = '77e1e9bf69b09ed0840534adb8258540' AND file:hashes.SHA1 = 'deadca9bd85ee5c4e086fd81eee09407b769e9b6' AND file:hashes.SHA256 = '0af253e60456b03af49cc675f71d47b2dd9a48f50a927e43b9d8116985c06459' AND file:hashes.SHA512 = '3ad6bd00c4195c9b1757a9d697196e8beffb343c331509c2eda24bbbd009cc1af552a1900ab04d169a22d273e6359cb2ff149050a7f792b9630108a4af226e2d']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-08-17T19:19:43.953009Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--74888f9e-4968-4601-944d-100a179c1b88",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-08-25T06:18:58.000Z",
"modified": "2023-08-25T06:18:58.000Z",
"labels": [
"misp:name=\"original-imported-file\"",
"misp:meta-category=\"file\""
],
"x_misp_attributes": [
{
"type": "attachment",
"object_relation": "imported-sample",
"value": "MAR-10459736.r1.v1.CLEAR_stix2.json",
"category": "External analysis",
"uuid": "3cebdcfe-65ce-4b62-b622-aa56867ef744",
"data": "ewogICAgInR5cGUiOiAiYnVuZGxlIiwKICAgICJpZCI6ICJidW5kbGUtLTc4ZDc0MDVkLWM3NjktNGVmYi05NTUwLTQwNWEzNThhMmQ3NiIsCiAgICAib2JqZWN0cyI6IFsKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogImlkZW50aXR5IiwKICAgICAgICAgICAgInNwZWNfdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAiaWQiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tNDJhYzNjOTItNjBkMi00MThmLWJhOGUtODM4OTQ0ZTYxMTBiIiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wNC0xMlQxNzo1MzowOS42NDZaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDQtMTJUMTc6NTM6MDkuNjQ2WiIsCiAgICAgICAgICAgICJuYW1lIjogIkdlbWluaVByb2R1Y3Rpb25fQ01BIiwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIkN5YmVyc2VjdXJpdHkgYW5kIEluZnJhc3RydWN0dXJlIFNlY3VyaXR5IEFnZW5jeSBQcm9kdWN0aW9uIElkZW50aXR5LiBDb2RlIGFuZCBNZWRpYSBBbmFseXNpcy4iLAogICAgICAgICAgICAiaWRlbnRpdHlfY2xhc3MiOiAic3lzdGVtIiwKICAgICAgICAgICAgImNvbmZpZGVuY2UiOiAxMDAsCiAgICAgICAgICAgICJsYW5nIjogImVuIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS1iYWI0YTYzYy1hZWQ5LTRjZjUtYTc2Ni1kZmNhNWFiYWMyYmIiCiAgICAgICAgICAgIF0KICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAiZmlsZSIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIsCiAgICAgICAgICAgICJoYXNoZXMiOiB7CiAgICAgICAgICAgICAgICAiTUQ1IjogIjc3ZTFlOWJmNjliMDllZDA4NDA1MzRhZGI4MjU4NTQwIiwKICAgICAgICAgICAgICAgICJTSEEtMSI6ICJkZWFkY2E5YmQ4NWVlNWM0ZTA4NmZkODFlZWUwOTQwN2I3NjllOWI2IiwKICAgICAgICAgICAgICAgICJTSEEtMjU2IjogIjBhZjI1M2U2MDQ1NmIwM2FmNDljYzY3NWY3MWQ0N2IyZGQ5YTQ4ZjUwYTkyN2U0M2I5ZDgxMTY5ODVjMDY0NTkiLAogICAgICAgICAgICAgICAgIlNIQS01MTIiOiAiM2FkNmJkMDBjNDE5NWM5YjE3NTdhOWQ2OTcxOTZlOGJlZmZiMzQzYzMzMTUwOWMyZWRhMjRiYmJkMDA5Y2MxYWY1NTJhMTkwMGFiMDRkMTY5YTIyZDI3M2U2MzU5Y2IyZmYxNDkwNTBhN2Y3OTJiOTYzMDEwOGE0YWYyMjZlMmQiLAogICAgICAgICAgICAgICAgIlNTREVFUCI6ICI5ODMwNDoxejJFR294aXBnME5QYnVxYlZ4Yk5ncUUrUStGNFlHWkx4NEJBRm0vQ3lVOkxMWFlHTkZMaiIKICAgICAgICAgICAgfSwKICAgICAgICAgICAgInNpemUiOiA1MDM0NjQ4LAogICAgICAgICAgICAibmFtZSI6ICJzc2xkIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS05NDg2OGM4OS04M2MyLTQ2NGItOTI5Yi1hMWE4YWEzYzg0ODciCiAgICAgICAgICAgIF0KICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAiaW5kaWNhdG9yIiwKICAgICAgICAgICAgInNwZWNfdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAiaWQiOiAiaW5kaWNhdG9yLS0zZTVmOGZjMC1kYTFmLTQ3ZjAtOGI2ZS1mNGM0YjAzM2NlNDciLAogICAgICAgICAgICAiY3JlYXRlZF9ieV9yZWYiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJtb2RpZmllZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAibmFtZSI6ICJzc2xkIiwKICAgICAgICAgICAgIm9iamVjdF9tYXJraW5nX3JlZnMiOiBbCiAgICAgICAgICAgICAgICAibWFya2luZy1kZWZpbml0aW9uLS05NDg2OGM4OS04M2MyLTQ2NGItOTI5Yi1hMWE4YWEzYzg0ODciCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJkZXNjcmlwdGlvbiI6ICJUaGUgZmlsZSAnc3NsZCcgaXMgYSBMaW51eCBFTEYgcmV2ZXJzZSBzaGVsbCBhbmQgaXMgYSB2YXJpYW50IG9mIFdISVJMUE9PTCBtYWx3YXJlIHVzZWQgb24gdGhlIEJhcnJhY3VkYSBFbWFpbCBTZWN1cml0eSBHYXRld2F5IChFU0cpIGRldmljZSAoRmlndXJlIDEpLiBUaGUgZmlsZSBsb29rcyBmb3IgYW4gZW5jb2RlZCBzdHJpbmcgd2l0aCBhICcuaW8nIGV4dGVuc2lvbiAoRmlndXJlIDIpLiBUaGUgc3RyaW5nIHdpbGwgYmUgZGVjb2RlZCBhbmQgdGhlIGRhdGEgd2lsbCBiZSBwYXNzZWQgYXMgdGhlIEMyIHdoaWNoIHdpbGwgaW5jbHVkZSB0aGUgSW50ZXJuZXQgUHJvdG9jb2wgKElQKSBhZGRyZXNzIGFuZCBwb3J0IG51bWJlciB1c2VkIHRvIGVzdGFibGlzaCBhIHJldmVyc2Ugc2hlbGwuIiwKICAgICAgICAgICAgImluZGljYXRvcl90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJtYWxpY2lvdXMtYWN0aXZpdHkiCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJwYXR0ZXJuIjogIiAnbmFtZXNwYWNlJz0nQ0lTQV9Db25zb2xpZGF0ZWQueWFyYScgcnVsZV9uYW1lPUNJU0FfMTA0NTIxMDhfMDIgcnVsZV9jb250ZW50PXJ1bGUgQ0lTQV8xMDQ1MjEwOF8wMiA6IFdISVJMUE9PTCBiYWNrZG9vciBjb21tdW5pY2F0ZXNfd2l0aF9jMiBpbnN0YWxsc19vdGhlcl9jb21wb25lbnRzXG57XG5cdG1ldGE6XG5cdFx0QXV0aG9yID0gXCJDSVNBIENvZGUgJiBNZWRpYSBBbmFseXNpc1wiXG5cdFx0SW5jaWRlbnQgPSBcIjEwNDUyMTA4XCJcblx0XHREYXRlID0gXCIyMDIzLTA2LTIwXCJcblx0XHRMYXN0X01vZGlmaWVkID0gXCIyMDIzMDgwNF8xNzMwXCJcblx0XHRBY3RvciA9IFwibi9hXCJcblx0XHRGYW1pbHkgPSBcIldISVJMUE9PTFwiXG5cdFx0Q2FwYWJpbGl0aWVzID0gXCJjb21tdW5pY2F0ZXMtd2l0aC1jMiBpbnN0YWxscy1vdGhlci1jb21wb25lbnRzXCJcblx0XHRNYWx3YXJlX1R5cGUgPSBcImJhY2tkb29yXCJcblx0XHRUb29sX1R5cGUgPSBcInVua25vd25cIlxuXHRcdERlc2NyaXB0aW9uID0gXCJEZXRlY3RzIG1hbGljaW91cyBMaW51eCBXSElSTFBPT0wgc2FtcGxlc1wiXG5cdFx0U0hBMjU2XzEgPSBcIjgzY2E2MzYyNTNmZDFlYjg5OGIyNDQ4NTU4MzhlMjI4MWYyNTdiYmU4ZWFkNDI4YjY5NTI4ZmM1MGI2MGFlOWNcIlxuXHRcdFNIQTI1Nl8yID0gXCI4ODQ5YTMyNzNlMDM2MmM0NWI0OTI4Mzc1ZDE5NjcxNDIyNGVjMjJjYjFkMmRmNWQwMjliZjU3MzQ5ODYwMzQ3XCJcblx0c3RyaW5nczpcblx0XHQkczAgPSB7IDY1IDcyIDcyIDZmIDcyIDIwIDJkIDMxIDIwIDY1IDc4IDY5IDc0IH1cblx0XHQkczEgPSB7IDYzIDcyIDY1IDYxIDc0IDY1IDIwIDczIDZmIDYzIDZiIDY1IDc0IDIwIDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDczIDI4IDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDY0IDI5IH1cblx0XHQkczIgPSB7IGM3IDAwIDIwIDMyIDNlIDI2IDY2IGM3IDQwIDA0IDMxIDAwIH1cblx0XHQkYTMgPSB7IDcwIDZjIDYxIDY5IDZlIDVmIDYzIDZmIDZlIDZlIDY1IDYzIDc0IH1cblx0XHQkYTQgPSB7IDYzIDZmIDZlIDZlIDY1IDYzIDc0IDIwIDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDczIDI4IDY1IDcyIDcyIDZmIDcyIDNhIDIwIDI1IDY0IDI5IH1cblx0XHQkYTUgPSB7IDczIDczIDZjIDVmIDYzIDZmIDZlIDZlIDY1IDYzIDc0IH1cblx0Y29uZGl0aW9uOlxuXHRcdHVpbnQzMigwKSA9PSAweDQ2NGM0NTdmIGFuZCA0IG9mIHRoZW1cbn1cbiIsCiAgICAgICAgICAgICJwYXR0ZXJuX3R5cGUiOiAieWFyYSIsCiAgICAgICAgICAgICJ2YWxpZF9mcm9tIjogIjIwMjMtMDgtMTdUMTk6MTk6NDMuOTQ0NjY4WiIKICAgICAgICB9LAogICAgICAgIHsKICAgICAgICAgICAgInR5cGUiOiAibWFsd2FyZS1hbmFseXNpcyIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogIm1hbHdhcmUtYW5hbHlzaXMtLTA3MTQxNTA2LWU5ODktNGEyNS1iNTEwLTc5NzM4M2U5YjAxYSIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tOGUxMTJlNzItYWE4Zi00MTkwLWEzNTktMjhhOWFiYWUyODk2IiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wOC0wOVQyMToxMjo1OS4wMDBaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJwcm9kdWN0IjogImVzZXQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgInJlc3VsdF9uYW1lIjogImEgdmFyaWFudCBvZiBMaW51eC9XaGlybFBvb2wuQSB0cm9qYW4iLAogICAgICAgICAgICAicmVzdWx0IjogInVua25vd24iLAogICAgICAgICAgICAic2FtcGxlX3JlZiI6ICJmaWxlLS1lZmQzZmQ5OC02ZjFiLTU5MGQtYmRkNC0xZTA3NTNkM2E2ODkiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogIm1hbHdhcmUiLAogICAgICAgICAgICAic3BlY192ZXJzaW9uIjogIjIuMSIsCiAgICAgICAgICAgICJpZCI6ICJtYWx3YXJlLS02MjZhMjU0OS01Nzc1LTQzYTgtYjhiYi0yZmUyNjgyYTZkYWUiLAogICAgICAgICAgICAiY3JlYXRlZF9ieV9yZWYiOiAiaWRlbnRpdHktLThlMTEyZTcyLWFhOGYtNDE5MC1hMzU5LTI4YTlhYmFlMjg5NiIsCiAgICAgICAgICAgICJjcmVhdGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJtb2RpZmllZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIlRoZSBmaWxlICdzc2xkJyBpcyBhIExpbnV4IEVMRiByZXZlcnNlIHNoZWxsIGFuZCBpcyBhIHZhcmlhbnQgb2YgV0hJUkxQT09MIG1hbHdhcmUgdXNlZCBvbiB0aGUgQmFycmFjdWRhIEVtYWlsIFNlY3VyaXR5IEdhdGV3YXkgKEVTRykgZGV2aWNlIChGaWd1cmUgMSkuIFRoZSBmaWxlIGxvb2tzIGZvciBhbiBlbmNvZGVkIHN0cmluZyB3aXRoIGEgJy5pbycgZXh0ZW5zaW9uIChGaWd1cmUgMikuIFRoZSBzdHJpbmcgd2lsbCBiZSBkZWNvZGVkIGFuZCB0aGUgZGF0YSB3aWxsIGJlIHBhc3NlZCBhcyB0aGUgQzIgd2hpY2ggd2lsbCBpbmNsdWRlIHRoZSBJbnRlcm5ldCBQcm90b2NvbCAoSVApIGFkZHJlc3MgYW5kIHBvcnQgbnVtYmVyIHVzZWQgdG8gZXN0YWJsaXNoIGEgcmV2ZXJzZSBzaGVsbC4iLAogICAgICAgICAgICAibWFsd2FyZV90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJ0cm9qYW4iCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJpc19mYW1pbHkiOiBmYWxzZSwKICAgICAgICAgICAgInNhbXBsZV9yZWZzIjogWwogICAgICAgICAgICAgICAgImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIKICAgICAgICAgICAgXQogICAgICAgIH0sCiAgICAgICAgewogICAgICAgICAgICAidHlwZSI6ICJpbmRpY2F0b3IiLAogICAgICAgICAgICAic3BlY192ZXJzaW9uIjogIjIuMSIsCiAgICAgICAgICAgICJpZCI6ICJpbmRpY2F0b3ItLTMxNTMyZmMwLWQzZWUtNDc5Zi04NDgyLWE0ZDQ5NzMyZDVhZiIsCiAgICAgICAgICAgICJjcmVhdGVkX2J5X3JlZiI6ICJpZGVudGl0eS0tOGUxMTJlNzItYWE4Zi00MTkwLWEzNTktMjhhOWFiYWUyODk2IiwKICAgICAgICAgICAgImNyZWF0ZWQiOiAiMjAyMy0wOC0wOVQyMToxMjo1OS4wMDBaIiwKICAgICAgICAgICAgIm1vZGlmaWVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTkuMDAwWiIsCiAgICAgICAgICAgICJuYW1lIjogInNzbGQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImluZGljYXRvcl90eXBlcyI6IFsKICAgICAgICAgICAgICAgICJtYWxpY2lvdXMtYWN0aXZpdHkiCiAgICAgICAgICAgIF0sCiAgICAgICAgICAgICJwYXR0ZXJuIjogIltmaWxlOmhhc2hlcy4nTUQ1Jz0nNzdlMWU5YmY2OWIwOWVkMDg0MDUzNGFkYjgyNTg1NDAnIE9SIGZpbGU6aGFzaGVzLidTSEEtMSc9J2RlYWRjYTliZDg1ZWU1YzRlMDg2ZmQ4MWVlZTA5NDA3Yjc2OWU5YjYnIE9SIGZpbGU6aGFzaGVzLidTSEEtMjU2Jz0nMGFmMjUzZTYwNDU2YjAzYWY0OWNjNjc1ZjcxZDQ3YjJkZDlhNDhmNTBhOTI3ZTQzYjlkODExNjk4NWMwNjQ1OScgT1IgZmlsZTpoYXNoZXMuJ1NIQS01MTInPSczYWQ2YmQwMGM0MTk1YzliMTc1N2E5ZDY5NzE5NmU4YmVmZmIzNDNjMzMxNTA5YzJlZGEyNGJiYmQwMDljYzFhZjU1MmExOTAwYWIwNGQxNjlhMjJkMjczZTYzNTljYjJmZjE0OTA1MGE3Zjc5MmI5NjMwMTA4YTRhZjIyNmUyZCddIiwKICAgICAgICAgICAgInBhdHRlcm5fdHlwZSI6ICJzdGl4IiwKICAgICAgICAgICAgInBhdHRlcm5fdmVyc2lvbiI6ICIyLjEiLAogICAgICAgICAgICAidmFsaWRfZnJvbSI6ICIyMDIzLTA4LTE3VDE5OjE5OjQzLjk1MzAwOVoiCiAgICAgICAgfSwKICAgICAgICB7CiAgICAgICAgICAgICJ0eXBlIjogInJlcG9ydCIsCiAgICAgICAgICAgICJzcGVjX3ZlcnNpb24iOiAiMi4xIiwKICAgICAgICAgICAgImlkIjogInJlcG9ydC0tNmI2ZmE0NmQtNGExNy00NGE0LWEyMzQtZDY5NDg3YjA0NTk3IiwKICAgICAgICAgICAgImNyZWF0ZWRfYnlfcmVmIjogImlkZW50aXR5LS04ZTExMmU3Mi1hYThmLTQxOTAtYTM1OS0yOGE5YWJhZTI4OTYiLAogICAgICAgICAgICAiY3JlYXRlZCI6ICIyMDIzLTA4LTA5VDIxOjEyOjU5LjAwMFoiLAogICAgICAgICAgICAibW9kaWZpZWQiOiAiMjAyMy0wOC0xN1QxOToxOTo0My45ODk0MjlaIiwKICAgICAgICAgICAgIm5hbWUiOiAiTUFSLTEwNDU5NzM2LnIxLnYxIC0gV0hJUkxQT09MIFZhcmlhbnQiLAogICAgICAgICAgICAib2JqZWN0X21hcmtpbmdfcmVmcyI6IFsKICAgICAgICAgICAgICAgICJtYXJraW5nLWRlZmluaXRpb24tLTk0ODY4Yzg5LTgzYzItNDY0Yi05MjliLWExYThhYTNjODQ4NyIKICAgICAgICAgICAgXSwKICAgICAgICAgICAgImRlc2NyaXB0aW9uIjogIkNJU0Egb2J0YWluZWQgYSB2YXJpYW50IG9mIHRoZSBXSElSTFBPT0wgYmFja2Rvb3IuIFRoZSBtYWx3YXJlIHdhcyB1c2VkIGJ5IHRocmVhdCBhY3RvcnMgZXhwbG9pdGluZyBDVkUtMjAyMy0yODY4LCBhIGZvcm1lciB6ZXJvLWRheSB2dWxuZXJhYmlsaXR5IGFmZmVjdGluZyB2ZXJzaW9ucyA1LjEuMy4wMDEtOS4yLjAuMDA2IG9mIEJhcnJhY3VkYSBFbWFpbCBTZWN1cml0eSBHYXRld2F5IChFU0cpLlxyXG5cclxuV0hJUkxQT09MIGlzIGEgYmFja2Rvb3IgdGhhdCBlc3RhYmxpc2hlcyBhIFRyYW5zcG9ydCBMYXllciBTZWN1cml0eSAoVExTKSByZXZlcnNlIHNoZWxsIHRvIHRoZSBDb21tYW5kLWFuZC1Db250cm9sIChDMikgc2VydmVyLlxyXG5cclxuRm9yIGluZm9ybWF0aW9uIGFib3V0IHJlbGF0ZWQgbWFsd2FyZSwgc3BlY2lmaWNhbGx5IGluZm9ybWF0aW9uIG9uIHRoZSBpbml0aWFsIGV4cGxvaXQgcGF5bG9hZCBhbmQgb3RoZXIgYmFja2Rvb3JzLCBzZWUgQ0lTQSBBbGVydDogQ0lTQSBSZWxlYXNlcyBNYWx3YXJlIEFuYWx5c2lzIFJlcG9ydHMgb24gQmFycmFjdWRhIEJhY2tkb29ycy4gICIsCiAgICAgICAgICAgICJyZXBvcnRfdHlwZXMiOiBbCiAgICAgICAgICAgICAgICAib2JzZXJ2ZWQtZGF0YSIsCiAgICAgICAgICAgICAgICAibWFsd2FyZSIsCiAgICAgICAgICAgICAgICAiaW5kaWNhdG9yIgogICAgICAgICAgICBdLAogICAgICAgICAgICAicHVibGlzaGVkIjogIjIwMjMtMDgtMDlUMjE6MTI6NTlaIiwKICAgICAgICAgICAgIm9iamVjdF9yZWZzIjogWwogICAgICAgICAgICAgICAgImlkZW50aXR5LS04ZTExMmU3Mi1hYThmLTQxOTAtYTM1OS0yOGE5YWJhZTI4OTYiLAogICAgICAgICAgICAgICAgImZpbGUtLWVmZDNmZDk4LTZmMWItNTkwZC1iZGQ0LTFlMDc1M2QzYTY4OSIsCiAgICAgICAgICAgICAgICAiaW5kaWNhdG9yLS0zZTVmOGZjMC1kYTFmLTQ3ZjAtOGI2ZS1mNGM0YjAzM2NlNDciLAogICAgICAgICAgICAgICAgIm1hbHdhcmUtYW5hbHlzaXMtLTA3MTQxNTA2LWU5ODktNGEyNS1iNTEwLTc5NzM4M2U5YjAxYSIsCiAgICAgICAgICAgICAgICAibWFsd2FyZS0tNjI2YTI1NDktNTc3NS00M2E4LWI4YmItMmZlMjY4MmE2ZGFlIiwKICAgICAgICAgICAgICAgICJpbmRpY2F0b3ItLTMxNTMyZmMwLWQzZWUtNDc5Zi04NDgyLWE0ZDQ5NzMyZDVhZiIKICAgICAgICAgICAgXQogICAgICAgIH0KICAgIF0KfQ=="
},
{
"type": "text",
"object_relation": "format",
"value": "STIX 2.1",
"category": "Other",
"uuid": "5c4002e7-7313-479e-911e-eb4920d76fc7"
}
],
"x_misp_meta_category": "file",
"x_misp_name": "original-imported-file"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--00012474-a0e7-4d07-b4f7-2a507fd15a15",
"created": "2023-08-25T06:18:51.000Z",
"modified": "2023-08-25T06:18:51.000Z",
"relationship_type": "analyses",
"source_ref": "x-misp-object--07141506-e989-4a25-b510-797383e9b01a",
"target_ref": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5905796b-7a63-42a2-a5b8-82ced29c030b",
"created": "2023-08-25T06:18:51.000Z",
"modified": "2023-08-25T06:18:51.000Z",
"relationship_type": "associated-with",
"source_ref": "indicator--efd3fd98-6f1b-590d-bdd4-1e0753d3a689",
"target_ref": "x-misp-object--626a2549-5775-43a8-b8bb-2fe2682a6dae"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink