729 lines
No EOL
30 KiB
JSON
729 lines
No EOL
30 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--54b62236-69d4-4154-854a-4862950d210b",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"name": "CthulhuSPRL.be",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--54b62236-69d4-4154-854a-4862950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"name": "OSINT Cridex, Feodo, Geodo, Dridex, whats next? by abuse.ch",
|
|
"published": "2016-02-22T15:16:06Z",
|
|
"object_refs": [
|
|
"observed-data--54b62282-9be0-4a87-ae0f-acbf950d210b",
|
|
"url--54b62282-9be0-4a87-ae0f-acbf950d210b",
|
|
"x-misp-attribute--54b6228a-01e8-4c71-852d-d563950d210b",
|
|
"indicator--54b622c7-5828-428f-9a06-0d21950d210b",
|
|
"indicator--54b622dc-aae0-4660-a75e-5d3c950d210b",
|
|
"indicator--54b62326-9260-4552-b9ae-4856950d210b",
|
|
"indicator--54b62326-c8a4-43f9-af29-4e1a950d210b",
|
|
"indicator--54b62326-4b78-4984-a5f1-4aae950d210b",
|
|
"indicator--54b62326-78c0-451a-b5ba-4416950d210b",
|
|
"indicator--54b62326-03ac-49ba-b4d6-4db9950d210b",
|
|
"indicator--54b62326-bacc-49ff-9b51-4922950d210b",
|
|
"indicator--54b62326-9210-4889-ab0a-4522950d210b",
|
|
"indicator--54b62336-65f0-4e17-ab96-6099950d210b",
|
|
"indicator--54b62336-da60-4905-86f6-6099950d210b",
|
|
"indicator--54b62336-e04c-43d3-956b-6099950d210b",
|
|
"indicator--54b62336-5334-4353-b414-6099950d210b",
|
|
"indicator--54b62336-6dd4-45cf-8651-6099950d210b",
|
|
"indicator--54b623be-2ac4-41ec-be31-5d3c950d210b",
|
|
"indicator--54b623be-e808-4f42-b450-5d3c950d210b",
|
|
"indicator--54b623be-9ff4-4e01-802b-5d3c950d210b",
|
|
"indicator--54b623be-7534-4356-a730-5d3c950d210b",
|
|
"indicator--56c64b6f-bc64-44f1-a5ba-4fd5950d210f",
|
|
"indicator--56c64b71-3f28-4405-be9e-c651950d210f",
|
|
"indicator--56c64b73-32ec-4ea5-9653-4f63950d210f",
|
|
"indicator--56c64b75-5360-49ac-a393-5ca1950d210f",
|
|
"indicator--56c64b70-fce4-47da-8cbf-c652950d210f",
|
|
"indicator--56c64b72-e594-4851-86d5-48a0950d210f",
|
|
"indicator--56c64b74-caf8-4c9b-8abe-599d950d210f",
|
|
"indicator--56c64b75-459c-4f0c-8daa-599e950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--54b62282-9be0-4a87-ae0f-acbf950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:02:10.000Z",
|
|
"modified": "2015-01-14T08:02:10.000Z",
|
|
"first_observed": "2015-01-14T08:02:10Z",
|
|
"last_observed": "2015-01-14T08:02:10Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--54b62282-9be0-4a87-ae0f-acbf950d210b"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--54b62282-9be0-4a87-ae0f-acbf950d210b",
|
|
"value": "https://www.abuse.ch/?p=8332"
|
|
},
|
|
{
|
|
"type": "x-misp-attribute",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-attribute--54b6228a-01e8-4c71-852d-d563950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:02:18.000Z",
|
|
"modified": "2015-01-14T08:02:18.000Z",
|
|
"labels": [
|
|
"misp:type=\"text\"",
|
|
"misp:category=\"External analysis\""
|
|
],
|
|
"x_misp_category": "External analysis",
|
|
"x_misp_type": "text",
|
|
"x_misp_value": "Dridex"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b622c7-5828-428f-9a06-0d21950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:03:19.000Z",
|
|
"modified": "2015-01-14T08:03:19.000Z",
|
|
"description": "port 443",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.28.113']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:03:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b622dc-aae0-4660-a75e-5d3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:03:40.000Z",
|
|
"modified": "2015-01-14T08:03:40.000Z",
|
|
"description": "port 9955",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '5.135.28.109']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:03:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-9260-4552-b9ae-4856950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '62.76.44.174']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-c8a4-43f9-af29-4e1a950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '50.56.34.20']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-4b78-4984-a5f1-4aae950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '37.139.47.177']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-78c0-451a-b5ba-4416950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '108.166.70.44']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-03ac-49ba-b4d6-4db9950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '202.124.205.84']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-bacc-49ff-9b51-4922950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '85.214.26.248']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62326-9210-4889-ab0a-4522950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:04:54.000Z",
|
|
"modified": "2015-01-14T08:04:54.000Z",
|
|
"description": "port 8080",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '178.208.81.204']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:04:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62336-65f0-4e17-ab96-6099950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:05:10.000Z",
|
|
"modified": "2015-01-14T08:05:10.000Z",
|
|
"pattern": "[file:hashes.MD5 = '532e7924f759aab014dedca651398ce6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:05:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62336-da60-4905-86f6-6099950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:05:10.000Z",
|
|
"modified": "2015-01-14T08:05:10.000Z",
|
|
"pattern": "[file:hashes.MD5 = '818bb82d1845eacedabdd5d0a5de310c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:05:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62336-e04c-43d3-956b-6099950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:05:10.000Z",
|
|
"modified": "2015-01-14T08:05:10.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'fab100a415254de5c8af70eb1c7eb2d0']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:05:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62336-5334-4353-b414-6099950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:05:10.000Z",
|
|
"modified": "2015-01-14T08:05:10.000Z",
|
|
"pattern": "[file:hashes.MD5 = '95d4a587ac1a128db890035793483885']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:05:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b62336-6dd4-45cf-8651-6099950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:05:10.000Z",
|
|
"modified": "2015-01-14T08:05:10.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'f8edaacbfc88a8f045bf2bbbd75c435b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:05:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b623be-2ac4-41ec-be31-5d3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"pattern": "[url:value = '/logs/ukvbvg/js.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:07:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b623be-e808-4f42-b450-5d3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"pattern": "[url:value = '/logs/ukvbvg/in.php']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:07:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b623be-9ff4-4e01-802b-5d3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"pattern": "[url:value = '/injectgate']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:07:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--54b623be-7534-4356-a730-5d3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-01-14T08:07:26.000Z",
|
|
"modified": "2015-01-14T08:07:26.000Z",
|
|
"pattern": "[url:value = '/tokengate']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-01-14T08:07:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b6f-bc64-44f1-a5ba-4fd5950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:35.000Z",
|
|
"modified": "2016-02-18T22:53:35.000Z",
|
|
"description": "Automatically added (via f8edaacbfc88a8f045bf2bbbd75c435b)",
|
|
"pattern": "[file:hashes.SHA1 = '444a3133c619eae0c899422684787372ec2291ba']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b71-3f28-4405-be9e-c651950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:37.000Z",
|
|
"modified": "2016-02-18T22:53:37.000Z",
|
|
"description": "Automatically added (via 95d4a587ac1a128db890035793483885)",
|
|
"pattern": "[file:hashes.SHA1 = '233de4235c7ca7534f19d97bf482b72776e2deb3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b73-32ec-4ea5-9653-4f63950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:39.000Z",
|
|
"modified": "2016-02-18T22:53:39.000Z",
|
|
"description": "Automatically added (via fab100a415254de5c8af70eb1c7eb2d0)",
|
|
"pattern": "[file:hashes.SHA1 = '70a2151dbdf1deff221e3c712054320a35751b7b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b75-5360-49ac-a393-5ca1950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:41.000Z",
|
|
"modified": "2016-02-18T22:53:41.000Z",
|
|
"description": "Automatically added (via 532e7924f759aab014dedca651398ce6)",
|
|
"pattern": "[file:hashes.SHA1 = '8f1dd9903815fad8ecfdb55fe277f425e8aa7cfc']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b70-fce4-47da-8cbf-c652950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:36.000Z",
|
|
"modified": "2016-02-18T22:53:36.000Z",
|
|
"description": "Automatically added (via f8edaacbfc88a8f045bf2bbbd75c435b)",
|
|
"pattern": "[file:hashes.SHA256 = 'ebb5c47f46954c5a6786cc040e5cc1a16d3765584f3f58cf1a3bf3fe7c9eceae']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b72-e594-4851-86d5-48a0950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:38.000Z",
|
|
"modified": "2016-02-18T22:53:38.000Z",
|
|
"description": "Automatically added (via 95d4a587ac1a128db890035793483885)",
|
|
"pattern": "[file:hashes.SHA256 = '76d759ff75723d76f3aa8cfe1785d220359c5b298a13db9d853cbca32d4752be']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b74-caf8-4c9b-8abe-599d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:40.000Z",
|
|
"modified": "2016-02-18T22:53:40.000Z",
|
|
"description": "Automatically added (via fab100a415254de5c8af70eb1c7eb2d0)",
|
|
"pattern": "[file:hashes.SHA256 = '62ba5cff1f48a529a6eb5f43fb790bc49433a9f0ed219f1ca0d890563eaea218']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56c64b75-459c-4f0c-8daa-599e950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2016-02-18T22:53:41.000Z",
|
|
"modified": "2016-02-18T22:53:41.000Z",
|
|
"description": "Automatically added (via 532e7924f759aab014dedca651398ce6)",
|
|
"pattern": "[file:hashes.SHA256 = '960ed795dca89e50745251adf6712719a1af1aa5fd1a66c9424c777574180548']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2016-02-18T22:53:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:GREEN",
|
|
"definition": {
|
|
"tlp": "green"
|
|
}
|
|
}
|
|
]
|
|
} |