3264 lines
No EOL
132 KiB
JSON
3264 lines
No EOL
132 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5637cc54-f260-4394-ba51-25ae950d210b",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:31.000Z",
|
|
"modified": "2015-12-22T14:24:31.000Z",
|
|
"name": "CthulhuSPRL.be",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5637cc54-f260-4394-ba51-25ae950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:31.000Z",
|
|
"modified": "2015-12-22T14:24:31.000Z",
|
|
"name": "OSINT - Case Study of Malicious Actors: Going Postal by CERT.pl",
|
|
"published": "2015-11-02T21:02:21Z",
|
|
"object_refs": [
|
|
"observed-data--5637cc6d-df64-4261-93fb-7d4a950d210b",
|
|
"url--5637cc6d-df64-4261-93fb-7d4a950d210b",
|
|
"indicator--5637cd81-6960-4da3-9a8b-7d4b950d210b",
|
|
"indicator--5637cd82-b218-453a-9ea2-7d4b950d210b",
|
|
"indicator--5637cd82-1eec-4f8b-9733-7d4b950d210b",
|
|
"indicator--5637cd83-24b0-4648-9011-7d4b950d210b",
|
|
"indicator--5637cd83-e960-4e22-8e6e-7d4b950d210b",
|
|
"indicator--5637cd83-3c48-485d-9357-7d4b950d210b",
|
|
"indicator--5637cd84-e11c-4e42-a1e9-7d4b950d210b",
|
|
"indicator--5637cd84-7d64-4e6d-9c3a-7d4b950d210b",
|
|
"indicator--5637cd84-97a4-46a1-b4b8-7d4b950d210b",
|
|
"indicator--5637cd85-ef78-47f0-a7d5-7d4b950d210b",
|
|
"indicator--5637cd85-8674-463c-ab68-7d4b950d210b",
|
|
"indicator--5637cece-5078-41ec-b0b5-4ec8950d210b",
|
|
"indicator--5637cece-b630-4ce0-9f1c-4129950d210b",
|
|
"indicator--5637cecf-d360-4035-9679-46c1950d210b",
|
|
"indicator--5637cecf-f460-4ea9-97de-4a43950d210b",
|
|
"indicator--5637ced0-9100-4a04-ba6c-44ec950d210b",
|
|
"indicator--5637ced0-b22c-4bd3-be76-49f3950d210b",
|
|
"indicator--5637ced1-b03c-4440-99fd-4ba0950d210b",
|
|
"indicator--5637ced1-42e4-43e3-a178-4425950d210b",
|
|
"indicator--5637ced2-09cc-46b4-94bd-4c34950d210b",
|
|
"indicator--5637ced2-7258-4ed8-9459-40ee950d210b",
|
|
"indicator--5637ced3-23bc-4658-b83f-41e2950d210b",
|
|
"indicator--5637ced3-0d40-4ace-b2d7-4e93950d210b",
|
|
"indicator--5637ced4-7dac-4108-8fcb-45fb950d210b",
|
|
"indicator--5637ced4-a30c-40f1-9811-4c10950d210b",
|
|
"indicator--5637ced4-797c-42ce-ae1e-4d86950d210b",
|
|
"indicator--5637ced5-c608-4042-982b-48de950d210b",
|
|
"indicator--5637ced5-ebdc-4f1a-b8b5-4d9d950d210b",
|
|
"indicator--5637ced6-2238-4805-b591-4b1f950d210b",
|
|
"indicator--5637ced6-de60-411c-a699-43d5950d210b",
|
|
"indicator--5637ced6-a108-467c-8bed-485a950d210b",
|
|
"indicator--5637ced7-7b84-4b93-b20c-4e65950d210b",
|
|
"indicator--5637ced7-ae5c-4efa-809c-46ad950d210b",
|
|
"indicator--5637ced8-a84c-4e39-b719-4108950d210b",
|
|
"indicator--5637ced8-b818-4487-80f8-4abc950d210b",
|
|
"indicator--5637ced8-0150-4748-825b-4058950d210b",
|
|
"indicator--5637ced9-abb8-46e4-a306-4c3c950d210b",
|
|
"indicator--5637ced9-9408-441b-b85a-4a77950d210b",
|
|
"indicator--5637ceda-eeec-46e5-99b0-4236950d210b",
|
|
"indicator--5637ceda-5e18-4265-b033-4df0950d210b",
|
|
"indicator--5637ceda-e124-4ad7-94d6-4cc3950d210b",
|
|
"indicator--5637cedb-3d0c-45a9-b6cc-4959950d210b",
|
|
"indicator--5637cedb-4b58-40a1-9df8-4eca950d210b",
|
|
"indicator--5637cedc-90a0-46fe-8bf9-4aab950d210b",
|
|
"indicator--5637cedc-beb4-4cae-8b6d-49c4950d210b",
|
|
"indicator--5637cedc-30a8-41ba-b490-4ea8950d210b",
|
|
"indicator--5637cedd-c760-42bf-bec3-4976950d210b",
|
|
"indicator--5637cedd-05cc-4526-8d83-4107950d210b",
|
|
"indicator--5637cede-d874-4de3-b8de-42cc950d210b",
|
|
"indicator--5637cede-ace8-4291-a0ec-444e950d210b",
|
|
"indicator--5637cede-f044-47db-8dff-4218950d210b",
|
|
"indicator--5637cedf-178c-48d0-aed0-4297950d210b",
|
|
"indicator--5637cedf-9cf8-4d11-8bff-49a4950d210b",
|
|
"indicator--5637cee0-cb50-4a55-9a48-4bd4950d210b",
|
|
"indicator--5637cee0-cfe4-41ac-b4a8-428b950d210b",
|
|
"indicator--5637cee0-e1d0-4b2e-bfc3-402f950d210b",
|
|
"indicator--5637cee1-7830-4c59-8010-4fbf950d210b",
|
|
"indicator--5637cee1-4160-4c4f-8c95-4195950d210b",
|
|
"indicator--5637cee2-6944-443c-9e0d-4d5f950d210b",
|
|
"indicator--5637cee2-8924-4ec2-8c18-47be950d210b",
|
|
"indicator--5637cee2-87a4-4473-80dd-4f7c950d210b",
|
|
"indicator--5637cee3-a1ec-4ec4-80ac-40ad950d210b",
|
|
"indicator--5637cee3-cdf0-409b-94cc-4065950d210b",
|
|
"indicator--5637cee4-c7c8-45f0-91c8-4c87950d210b",
|
|
"indicator--5637cee4-be4c-4f2c-b7a7-4176950d210b",
|
|
"indicator--5637cee4-ecf4-4a5a-9c2d-44c2950d210b",
|
|
"indicator--5637cee5-65dc-4cb4-b6ec-4bfc950d210b",
|
|
"indicator--5637cee5-bea0-4ffa-a173-419d950d210b",
|
|
"indicator--5637cee6-8ebc-4368-a6eb-44b4950d210b",
|
|
"indicator--5637cee6-999c-43fb-80c3-4fd4950d210b",
|
|
"indicator--5637cee6-b070-423b-bebd-4a2f950d210b",
|
|
"indicator--5637cee7-608c-4f19-b415-4177950d210b",
|
|
"indicator--5637cee7-70c8-4370-a94c-4d4b950d210b",
|
|
"indicator--5637cee7-6d60-450a-bf61-447f950d210b",
|
|
"indicator--5637cee8-3d60-4330-8039-495c950d210b",
|
|
"indicator--5637cee8-bdac-4e2d-ab9d-4228950d210b",
|
|
"indicator--5637cee9-f998-4ff3-b5bc-44f9950d210b",
|
|
"indicator--5637cee9-c95c-404a-8c10-43eb950d210b",
|
|
"indicator--5637ceea-7ac8-4c6b-bbb7-4e21950d210b",
|
|
"indicator--5637ceea-e558-4faa-906e-4d8c950d210b",
|
|
"indicator--5637ceea-d4ec-48ee-8e06-41e2950d210b",
|
|
"indicator--5637ceeb-36cc-4883-b3ea-4407950d210b",
|
|
"indicator--5637ceeb-de68-4e4d-85b1-437d950d210b",
|
|
"indicator--5637ceec-ad5c-4646-a9a3-4f6e950d210b",
|
|
"indicator--5637ceec-85fc-4480-879b-45f2950d210b",
|
|
"indicator--5637ceed-8a48-4066-b52a-4839950d210b",
|
|
"indicator--5637ceed-8884-4d02-a551-407c950d210b",
|
|
"indicator--5637ceed-b43c-4e1e-b20b-4f5c950d210b",
|
|
"indicator--5637ceee-f288-4ade-998e-4dd8950d210b",
|
|
"indicator--5637ceee-239c-4806-b646-4ff6950d210b",
|
|
"indicator--5637ceef-bd98-4848-ac89-4462950d210b",
|
|
"indicator--5637ceef-0c94-4fe4-bff4-4468950d210b",
|
|
"indicator--5637ceef-1930-4eb8-9e88-4d3d950d210b",
|
|
"indicator--5637cef0-e35c-404b-bb50-4bf0950d210b",
|
|
"indicator--5637cef0-4b24-4925-8770-4987950d210b",
|
|
"indicator--5637cef1-8744-42e6-9d9d-4f18950d210b",
|
|
"indicator--56795d1f-54a0-4583-99ef-4c4b950d210f",
|
|
"indicator--56795d1f-f7b8-4a5b-94ef-4139950d210f",
|
|
"indicator--56795d20-bcb0-4c1b-9602-4477950d210f",
|
|
"indicator--56795d20-8bcc-42e7-822e-401d950d210f",
|
|
"indicator--56795d20-9d18-4ff4-85f1-40c5950d210f",
|
|
"indicator--56795d20-f780-4a8b-b26f-4035950d210f",
|
|
"indicator--56795d21-3d24-4a67-a2e1-4216950d210f",
|
|
"indicator--56795d21-9634-4534-93b9-4244950d210f",
|
|
"indicator--56795d21-e954-47c2-90b4-4144950d210f",
|
|
"indicator--56795d22-78d4-4573-8765-43c5950d210f",
|
|
"indicator--56795d22-285c-4341-8fef-4732950d210f",
|
|
"indicator--56795d22-177c-458f-87e6-4b62950d210f",
|
|
"indicator--56795d23-8850-4b0d-9867-4051950d210f",
|
|
"indicator--56795d23-1680-4f72-b9ca-49cc950d210f",
|
|
"indicator--56795d23-af3c-427a-ba02-4370950d210f",
|
|
"indicator--56795d23-c078-4ea0-9db1-4ed5950d210f",
|
|
"indicator--56795d24-df78-4dca-b4e2-46ca950d210f",
|
|
"indicator--56795d24-c808-4c85-9eb2-4620950d210f",
|
|
"indicator--56795d24-4750-4bea-b915-49b6950d210f",
|
|
"indicator--56795d25-4580-4cb8-8e24-47f5950d210f",
|
|
"indicator--56795d25-a9bc-4e6d-89c2-4dd7950d210f",
|
|
"indicator--56795d25-17c8-451f-882f-4a4c950d210f",
|
|
"indicator--56795d25-d96c-4b2a-8a0d-4f1c950d210f",
|
|
"indicator--56795d26-5e30-446a-a97d-4624950d210f",
|
|
"indicator--56795d26-b91c-460d-9e7d-4a21950d210f",
|
|
"indicator--56795d26-b2dc-4452-bbde-436e950d210f",
|
|
"indicator--56795d27-1c30-4727-8611-436d950d210f",
|
|
"indicator--56795d27-8ed4-47b3-8f9c-418a950d210f",
|
|
"indicator--56795d27-99e0-478d-a394-4aea950d210f",
|
|
"indicator--56795d28-4fe8-41e3-b25e-4124950d210f",
|
|
"indicator--56795d28-1d48-4669-a7b8-49aa950d210f",
|
|
"indicator--56795d28-cc00-42b7-8ec8-4488950d210f",
|
|
"indicator--56795d28-9c10-4172-9329-42c1950d210f",
|
|
"indicator--56795d29-9454-40a3-a5ed-493e950d210f",
|
|
"indicator--56795d29-5a44-4d55-b836-450d950d210f",
|
|
"indicator--56795d29-2da0-4ee3-8e8e-4aaf950d210f"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"type:OSINT"
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5637cc6d-df64-4261-93fb-7d4a950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:49:49.000Z",
|
|
"modified": "2015-11-02T20:49:49.000Z",
|
|
"first_observed": "2015-11-02T20:49:49Z",
|
|
"last_observed": "2015-11-02T20:49:49Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5637cc6d-df64-4261-93fb-7d4a950d210b"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5637cc6d-df64-4261-93fb-7d4a950d210b",
|
|
"value": "http://www.cert.pl/PDF/The_Postal_Group.pdf"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd81-6960-4da3-9a8b-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:25.000Z",
|
|
"modified": "2015-11-02T20:54:25.000Z",
|
|
"pattern": "[domain-name:value = 'sub-host-peer.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd82-b218-453a-9ea2-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:26.000Z",
|
|
"modified": "2015-11-02T20:54:26.000Z",
|
|
"pattern": "[domain-name:value = 'dynayo-rooxo-gabtype.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd82-1eec-4f8b-9733-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:26.000Z",
|
|
"modified": "2015-11-02T20:54:26.000Z",
|
|
"pattern": "[domain-name:value = 'skinder-chatcast-topcat.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd83-24b0-4648-9011-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:26.000Z",
|
|
"modified": "2015-11-02T20:54:26.000Z",
|
|
"pattern": "[domain-name:value = 'topcat-centido-abadel.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd83-e960-4e22-8e6e-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:27.000Z",
|
|
"modified": "2015-11-02T20:54:27.000Z",
|
|
"pattern": "[domain-name:value = 'twitterbug-flashpedia-skipster.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd83-3c48-485d-9357-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:27.000Z",
|
|
"modified": "2015-11-02T20:54:27.000Z",
|
|
"pattern": "[domain-name:value = 'digiify-devify-chatfly.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd84-e11c-4e42-a1e9-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:28.000Z",
|
|
"modified": "2015-11-02T20:54:28.000Z",
|
|
"pattern": "[domain-name:value = 'teknation-brighttube-zoomtag.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd84-7d64-4e6d-9c3a-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:28.000Z",
|
|
"modified": "2015-11-02T20:54:28.000Z",
|
|
"pattern": "[domain-name:value = 'meevee-yamba-dynatri.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd84-97a4-46a1-b4b8-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:28.000Z",
|
|
"modified": "2015-11-02T20:54:28.000Z",
|
|
"pattern": "[domain-name:value = 'bizzanalytics.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd85-ef78-47f0-a7d5-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:29.000Z",
|
|
"modified": "2015-11-02T20:54:29.000Z",
|
|
"pattern": "[domain-name:value = 'gtagmanager.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cd85-8674-463c-ab68-7d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:54:29.000Z",
|
|
"modified": "2015-11-02T20:54:29.000Z",
|
|
"pattern": "[domain-name:value = 'wholetdiedogsout.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:54:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cece-5078-41ec-b0b5-4ec8950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:59:58.000Z",
|
|
"modified": "2015-11-02T20:59:58.000Z",
|
|
"pattern": "[domain-name:value = 'mixpornotube.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:59:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cece-b630-4ce0-9f1c-4129950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:59:58.000Z",
|
|
"modified": "2015-11-02T20:59:58.000Z",
|
|
"pattern": "[domain-name:value = 'varetz.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:59:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cecf-d360-4035-9679-46c1950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:59:59.000Z",
|
|
"modified": "2015-11-02T20:59:59.000Z",
|
|
"pattern": "[domain-name:value = 'androidflv.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:59:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cecf-f460-4ea9-97de-4a43950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T20:59:59.000Z",
|
|
"modified": "2015-11-02T20:59:59.000Z",
|
|
"pattern": "[domain-name:value = 'inter-host-media.in']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T20:59:59Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced0-9100-4a04-ba6c-44ec950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:00.000Z",
|
|
"modified": "2015-11-02T21:00:00.000Z",
|
|
"pattern": "[domain-name:value = 'mini0pera.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced0-b22c-4bd3-be76-49f3950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:00.000Z",
|
|
"modified": "2015-11-02T21:00:00.000Z",
|
|
"pattern": "[domain-name:value = 'androidbrowser.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced1-b03c-4440-99fd-4ba0950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:01.000Z",
|
|
"modified": "2015-11-02T21:00:01.000Z",
|
|
"pattern": "[domain-name:value = 'porno18teens.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced1-42e4-43e3-a178-4425950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:01.000Z",
|
|
"modified": "2015-11-02T21:00:01.000Z",
|
|
"pattern": "[domain-name:value = 'porno18teens.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:01Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced2-09cc-46b4-94bd-4c34950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:02.000Z",
|
|
"modified": "2015-11-02T21:00:02.000Z",
|
|
"pattern": "[domain-name:value = 'privateswingerclub.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced2-7258-4ed8-9459-40ee950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:02.000Z",
|
|
"modified": "2015-11-02T21:00:02.000Z",
|
|
"pattern": "[domain-name:value = 'crossfit-air.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced3-23bc-4658-b83f-41e2950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:03.000Z",
|
|
"modified": "2015-11-02T21:00:03.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.161.30.225']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced3-0d40-4ace-b2d7-4e93950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:03.000Z",
|
|
"modified": "2015-11-02T21:00:03.000Z",
|
|
"pattern": "[domain-name:value = 'pocztapolska.biz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:03Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced4-7dac-4108-8fcb-45fb950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:04.000Z",
|
|
"modified": "2015-11-02T21:00:04.000Z",
|
|
"pattern": "[domain-name:value = 'bounaromnabouna.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced4-a30c-40f1-9811-4c10950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:04.000Z",
|
|
"modified": "2015-11-02T21:00:04.000Z",
|
|
"pattern": "[domain-name:value = 'getyourpostrack.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced4-797c-42ce-ae1e-4d86950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:04.000Z",
|
|
"modified": "2015-11-02T21:00:04.000Z",
|
|
"pattern": "[domain-name:value = 'drivewarning.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:04Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced5-c608-4042-982b-48de950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:05.000Z",
|
|
"modified": "2015-11-02T21:00:05.000Z",
|
|
"pattern": "[domain-name:value = 'trackthingnotice.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced5-ebdc-4f1a-b8b5-4d9d950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:05.000Z",
|
|
"modified": "2015-11-02T21:00:05.000Z",
|
|
"pattern": "[domain-name:value = 'carefuldrive.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:05Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced6-2238-4805-b591-4b1f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:06.000Z",
|
|
"modified": "2015-11-02T21:00:06.000Z",
|
|
"pattern": "[domain-name:value = 'poczta-sledzenie.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced6-de60-411c-a699-43d5950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:06.000Z",
|
|
"modified": "2015-11-02T21:00:06.000Z",
|
|
"pattern": "[domain-name:value = 'polska-poczta.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced6-a108-467c-8bed-485a950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:06.000Z",
|
|
"modified": "2015-11-02T21:00:06.000Z",
|
|
"pattern": "[domain-name:value = 'polskapoczta.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced7-7b84-4b93-b20c-4e65950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:07.000Z",
|
|
"modified": "2015-11-02T21:00:07.000Z",
|
|
"pattern": "[domain-name:value = 'poczta-polska.info']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced7-ae5c-4efa-809c-46ad950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:07.000Z",
|
|
"modified": "2015-11-02T21:00:07.000Z",
|
|
"pattern": "[domain-name:value = 'correosportal24.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:07Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced8-a84c-4e39-b719-4108950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:08.000Z",
|
|
"modified": "2015-11-02T21:00:08.000Z",
|
|
"pattern": "[domain-name:value = 'correos-portal.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced8-b818-4487-80f8-4abc950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:08.000Z",
|
|
"modified": "2015-11-02T21:00:08.000Z",
|
|
"pattern": "[domain-name:value = 'au-violation.org']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced8-0150-4748-825b-4058950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:08.000Z",
|
|
"modified": "2015-11-02T21:00:08.000Z",
|
|
"pattern": "[url:value = '46.161.30.225slave']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:08Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"url\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced9-abb8-46e4-a306-4c3c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:09.000Z",
|
|
"modified": "2015-11-02T21:00:09.000Z",
|
|
"pattern": "[domain-name:value = 'tweeter-stat.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ced9-9408-441b-b85a-4a77950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:09.000Z",
|
|
"modified": "2015-11-02T21:00:09.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.161.30.16']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:09Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceda-eeec-46e5-99b0-4236950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:10.000Z",
|
|
"modified": "2015-11-02T21:00:10.000Z",
|
|
"pattern": "[domain-name:value = 'walkingdead32.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceda-5e18-4265-b033-4df0950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:10.000Z",
|
|
"modified": "2015-11-02T21:00:10.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.161.30.17']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceda-e124-4ad7-94d6-4cc3950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:10.000Z",
|
|
"modified": "2015-11-02T21:00:10.000Z",
|
|
"pattern": "[domain-name:value = 'firaridole.ecocentronatal.com.br']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:10Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedb-3d0c-45a9-b6cc-4959950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:11.000Z",
|
|
"modified": "2015-11-02T21:00:11.000Z",
|
|
"pattern": "[domain-name:value = 'cihuyuvubo.redcarpetaffairs.co.uk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedb-4b58-40a1-9df8-4eca950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:11.000Z",
|
|
"modified": "2015-11-02T21:00:11.000Z",
|
|
"pattern": "[domain-name:value = 'haseyetehu.yerkopetricic.cl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:11Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedc-90a0-46fe-8bf9-4aab950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:12.000Z",
|
|
"modified": "2015-11-02T21:00:12.000Z",
|
|
"pattern": "[domain-name:value = 'fewemuveba.darwinblocks.com.au']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedc-beb4-4cae-8b6d-49c4950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:12.000Z",
|
|
"modified": "2015-11-02T21:00:12.000Z",
|
|
"pattern": "[domain-name:value = 'vabavimune.deks-bud.pl']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedc-30a8-41ba-b490-4ea8950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:12.000Z",
|
|
"modified": "2015-11-02T21:00:12.000Z",
|
|
"pattern": "[domain-name:value = 'wiwoticeyo.ofertasnz.com.br']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedd-c760-42bf-bec3-4976950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:13.000Z",
|
|
"modified": "2015-11-02T21:00:13.000Z",
|
|
"pattern": "[domain-name:value = 'jeyejogeye.rawmilkcanada.ca']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedd-05cc-4526-8d83-4107950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:13.000Z",
|
|
"modified": "2015-11-02T21:00:13.000Z",
|
|
"pattern": "[domain-name:value = 'zergsased.nearys.co.uk']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:13Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cede-d874-4de3-b8de-42cc950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:14.000Z",
|
|
"modified": "2015-11-02T21:00:14.000Z",
|
|
"pattern": "[domain-name:value = 'sejehepowa.descaracterizacao.com.br']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cede-ace8-4291-a0ec-444e950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:14.000Z",
|
|
"modified": "2015-11-02T21:00:14.000Z",
|
|
"pattern": "[domain-name:value = 'waxelokofo.cantamariaexpresso.com.br']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cede-f044-47db-8dff-4218950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:14.000Z",
|
|
"modified": "2015-11-02T21:00:14.000Z",
|
|
"pattern": "[domain-name:value = 'cirupopupe.banque.tw']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:14Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedf-178c-48d0-aed0-4297950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:15.000Z",
|
|
"modified": "2015-11-02T21:00:15.000Z",
|
|
"pattern": "[domain-name:value = 'hipovahaku.emall.kz']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cedf-9cf8-4d11-8bff-49a4950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:15.000Z",
|
|
"modified": "2015-11-02T21:00:15.000Z",
|
|
"pattern": "[domain-name:value = 'pipolifoho.cosmic.al']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee0-cb50-4a55-9a48-4bd4950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:16.000Z",
|
|
"modified": "2015-11-02T21:00:16.000Z",
|
|
"pattern": "[domain-name:value = 'lobukehali.bazarjesus.pt']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee0-cfe4-41ac-b4a8-428b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:16.000Z",
|
|
"modified": "2015-11-02T21:00:16.000Z",
|
|
"pattern": "[domain-name:value = 'velonujuyi.mysystem.ec']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee0-e1d0-4b2e-bfc3-402f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:16.000Z",
|
|
"modified": "2015-11-02T21:00:16.000Z",
|
|
"pattern": "[domain-name:value = 'mom-soldi-home-blog.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee1-7830-4c59-8010-4fbf950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:17.000Z",
|
|
"modified": "2015-11-02T21:00:17.000Z",
|
|
"pattern": "[domain-name:value = 'mamaprofitwork.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee1-4160-4c4f-8c95-4195950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:17.000Z",
|
|
"modified": "2015-11-02T21:00:17.000Z",
|
|
"pattern": "[domain-name:value = 'systememichelle-revenu.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:17Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee2-6944-443c-9e0d-4d5f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:18.000Z",
|
|
"modified": "2015-11-02T21:00:18.000Z",
|
|
"pattern": "[domain-name:value = 'elena-home-work.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee2-8924-4ec2-8c18-47be950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:18.000Z",
|
|
"modified": "2015-11-02T21:00:18.000Z",
|
|
"pattern": "[domain-name:value = 'systememichellerevenu.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee2-87a4-4473-80dd-4f7c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:18.000Z",
|
|
"modified": "2015-11-02T21:00:18.000Z",
|
|
"pattern": "[domain-name:value = 'einkommenhausmichelle.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:18Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee3-a1ec-4ec4-80ac-40ad950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:19.000Z",
|
|
"modified": "2015-11-02T21:00:19.000Z",
|
|
"pattern": "[domain-name:value = 'mom-michelle-successo.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee3-cdf0-409b-94cc-4065950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:19.000Z",
|
|
"modified": "2015-11-02T21:00:19.000Z",
|
|
"pattern": "[domain-name:value = 'my-profit-method.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee4-c7c8-45f0-91c8-4c87950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:20.000Z",
|
|
"modified": "2015-11-02T21:00:20.000Z",
|
|
"pattern": "[domain-name:value = 'webrxtopstore.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee4-be4c-4f2c-b7a7-4176950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:20.000Z",
|
|
"modified": "2015-11-02T21:00:20.000Z",
|
|
"pattern": "[domain-name:value = 'bestomedoshopo.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee4-ecf4-4a5a-9c2d-44c2950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:20.000Z",
|
|
"modified": "2015-11-02T21:00:20.000Z",
|
|
"pattern": "[domain-name:value = 'storerxweb.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee5-65dc-4cb4-b6ec-4bfc950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:21.000Z",
|
|
"modified": "2015-11-02T21:00:21.000Z",
|
|
"pattern": "[domain-name:value = 'bluerxproduct.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee5-bea0-4ffa-a173-419d950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:21.000Z",
|
|
"modified": "2015-11-02T21:00:21.000Z",
|
|
"pattern": "[domain-name:value = 'rxwebstore.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee6-8ebc-4368-a6eb-44b4950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:22.000Z",
|
|
"modified": "2015-11-02T21:00:22.000Z",
|
|
"pattern": "[domain-name:value = 'rxmartonline.ru']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee6-999c-43fb-80c3-4fd4950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:22.000Z",
|
|
"modified": "2015-11-02T21:00:22.000Z",
|
|
"pattern": "[domain-name:value = 'freebonusrx.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee6-b070-423b-bebd-4a2f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:22.000Z",
|
|
"modified": "2015-11-02T21:00:22.000Z",
|
|
"pattern": "[domain-name:value = '18pretty.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:22Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee7-608c-4f19-b415-4177950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:23.000Z",
|
|
"modified": "2015-11-02T21:00:23.000Z",
|
|
"pattern": "[domain-name:value = 'hentailake.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee7-70c8-4370-a94c-4d4b950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:23.000Z",
|
|
"modified": "2015-11-02T21:00:23.000Z",
|
|
"pattern": "[domain-name:value = 'amour-angels.pw']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee7-6d60-450a-bf61-447f950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:23.000Z",
|
|
"modified": "2015-11-02T21:00:23.000Z",
|
|
"pattern": "[domain-name:value = 'grouphookupdate.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:23Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee8-3d60-4330-8039-495c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:24.000Z",
|
|
"modified": "2015-11-02T21:00:24.000Z",
|
|
"pattern": "[domain-name:value = 'mega-fuckbook.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee8-bdac-4e2d-ab9d-4228950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:24.000Z",
|
|
"modified": "2015-11-02T21:00:24.000Z",
|
|
"pattern": "[domain-name:value = 'ihookup-tonight.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee9-f998-4ff3-b5bc-44f9950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:25.000Z",
|
|
"modified": "2015-11-02T21:00:25.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '46.151.53.40']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cee9-c95c-404a-8c10-43eb950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:25.000Z",
|
|
"modified": "2015-11-02T21:00:25.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '109.68.190.175']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:25Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceea-7ac8-4c6b-bbb7-4e21950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:26.000Z",
|
|
"modified": "2015-11-02T21:00:26.000Z",
|
|
"pattern": "[domain-name:value = 'auspost24.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceea-e558-4faa-906e-4d8c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:26.000Z",
|
|
"modified": "2015-11-02T21:00:26.000Z",
|
|
"pattern": "[domain-name:value = 'mail.auspost24.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceea-d4ec-48ee-8e06-41e2950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:26.000Z",
|
|
"modified": "2015-11-02T21:00:26.000Z",
|
|
"pattern": "[domain-name:value = 'auspost-track24.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceeb-36cc-4883-b3ea-4407950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:27.000Z",
|
|
"modified": "2015-11-02T21:00:27.000Z",
|
|
"pattern": "[domain-name:value = 'mail.auspost-track24.net']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"hostname\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceeb-de68-4e4d-85b1-437d950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:27.000Z",
|
|
"modified": "2015-11-02T21:00:27.000Z",
|
|
"pattern": "[network-traffic:dst_ref.type = 'ipv4-addr' AND network-traffic:dst_ref.value = '176.97.116.164']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"ip-dst\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceec-ad5c-4646-a9a3-4f6e950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:28.000Z",
|
|
"modified": "2015-11-02T21:00:28.000Z",
|
|
"pattern": "[domain-name:value = 'mymotherhascome.com']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Network activity"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"domain\"",
|
|
"misp:category=\"Network activity\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceec-85fc-4480-879b-45f2950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:28.000Z",
|
|
"modified": "2015-11-02T21:00:28.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'b566239fc3854276619d7c0c157b837fcda02b6878014549f524de4c89f57b37']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:28Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceed-8a48-4066-b52a-4839950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:29.000Z",
|
|
"modified": "2015-11-02T21:00:29.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '3ab0beaf860e12b318f97dfdc629c066e71b0891e1bfd92473db82b86cc93012']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceed-8884-4d02-a551-407c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:29.000Z",
|
|
"modified": "2015-11-02T21:00:29.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '7cdf57eca5220399c45ddb92eed4bf1ac879ef4dbf150cba190b546b77b50357']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceed-b43c-4e1e-b20b-4f5c950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:29.000Z",
|
|
"modified": "2015-11-02T21:00:29.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '07f29192a339791a997c1a58ba58fa24dff31a60924110a610ed04cd691dac80']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:29Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceee-f288-4ade-998e-4dd8950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:30.000Z",
|
|
"modified": "2015-11-02T21:00:30.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '9d7dbb4de40e0ef8867500988653cea03fa89a0c62dcc56a3739327f8a24d504']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceee-239c-4806-b646-4ff6950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:30.000Z",
|
|
"modified": "2015-11-02T21:00:30.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '94a4809a3ba8d40407c7d1f0cfc0b84446fa417a624043bb621879b42832108c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:30Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceef-bd98-4848-ac89-4462950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:31.000Z",
|
|
"modified": "2015-11-02T21:00:31.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '9eb68bd28de11fdfb397ba67605c3924d8d32e2ee5473209311ca608f212d4c2']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceef-0c94-4fe4-bff4-4468950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:31.000Z",
|
|
"modified": "2015-11-02T21:00:31.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '91d8acd8f3c89b92c39ace385a67ac992fae5e56cf8f8c73b8b02e4e4c58deff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637ceef-1930-4eb8-9e88-4d3d950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:31.000Z",
|
|
"modified": "2015-11-02T21:00:31.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'f9f7b0b949c1206c15b9f94702efb6d728988d4ae350748aa481cbf621136260']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cef0-e35c-404b-bb50-4bf0950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:32.000Z",
|
|
"modified": "2015-11-02T21:00:32.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'df87eac90c5f3f04ccf2e38b38c196a00a6c3b225d790bab1cc97fb6c6ef67a1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cef0-4b24-4925-8770-4987950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:32.000Z",
|
|
"modified": "2015-11-02T21:00:32.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '85cf88e113429393b4f0a4984f45dc0fb97e2a24b3c96f656607abe139504648']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5637cef1-8744-42e6-9d9d-4f18950d210b",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-11-02T21:00:33.000Z",
|
|
"modified": "2015-11-02T21:00:33.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'bcb7677cfe84ee85418c018f4fb13811637f05bc1234a9dd5e9be15d13a113ff']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-11-02T21:00:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha256\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d1f-54a0-4583-99ef-4c4b950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:31.000Z",
|
|
"modified": "2015-12-22T14:24:31.000Z",
|
|
"description": "- Xchecked via VT: bcb7677cfe84ee85418c018f4fb13811637f05bc1234a9dd5e9be15d13a113ff",
|
|
"pattern": "[file:hashes.SHA1 = '8138d13023baaab29cf48e950a697e1c87fc2aaa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d1f-f7b8-4a5b-94ef-4139950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:31.000Z",
|
|
"modified": "2015-12-22T14:24:31.000Z",
|
|
"description": "- Xchecked via VT: bcb7677cfe84ee85418c018f4fb13811637f05bc1234a9dd5e9be15d13a113ff",
|
|
"pattern": "[file:hashes.MD5 = 'aba29b7e6a148f79494356576dd82a34']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:31Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d20-bcb0-4c1b-9602-4477950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:32.000Z",
|
|
"modified": "2015-12-22T14:24:32.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/bcb7677cfe84ee85418c018f4fb13811637f05bc1234a9dd5e9be15d13a113ff/analysis/1437568707/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d20-8bcc-42e7-822e-401d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:32.000Z",
|
|
"modified": "2015-12-22T14:24:32.000Z",
|
|
"description": "- Xchecked via VT: 85cf88e113429393b4f0a4984f45dc0fb97e2a24b3c96f656607abe139504648",
|
|
"pattern": "[file:hashes.SHA1 = '34d754fef4b443e007915e4b1cffc6527543b065']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d20-9d18-4ff4-85f1-40c5950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:32.000Z",
|
|
"modified": "2015-12-22T14:24:32.000Z",
|
|
"description": "- Xchecked via VT: 85cf88e113429393b4f0a4984f45dc0fb97e2a24b3c96f656607abe139504648",
|
|
"pattern": "[file:hashes.MD5 = 'b63c893b714d2da6fff735d9459a667c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d20-f780-4a8b-b26f-4035950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:32.000Z",
|
|
"modified": "2015-12-22T14:24:32.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/85cf88e113429393b4f0a4984f45dc0fb97e2a24b3c96f656607abe139504648/analysis/1446729756/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:32Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d21-3d24-4a67-a2e1-4216950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:33.000Z",
|
|
"modified": "2015-12-22T14:24:33.000Z",
|
|
"description": "- Xchecked via VT: df87eac90c5f3f04ccf2e38b38c196a00a6c3b225d790bab1cc97fb6c6ef67a1",
|
|
"pattern": "[file:hashes.SHA1 = '5ee4ce7f46e493e35bc49782232d574402bf9b56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d21-9634-4534-93b9-4244950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:33.000Z",
|
|
"modified": "2015-12-22T14:24:33.000Z",
|
|
"description": "- Xchecked via VT: df87eac90c5f3f04ccf2e38b38c196a00a6c3b225d790bab1cc97fb6c6ef67a1",
|
|
"pattern": "[file:hashes.MD5 = 'c9c98e486a41b5609a38f358177bdb0e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d21-e954-47c2-90b4-4144950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:33.000Z",
|
|
"modified": "2015-12-22T14:24:33.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/df87eac90c5f3f04ccf2e38b38c196a00a6c3b225d790bab1cc97fb6c6ef67a1/analysis/1449639853/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:33Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d22-78d4-4573-8765-43c5950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:34.000Z",
|
|
"modified": "2015-12-22T14:24:34.000Z",
|
|
"description": "- Xchecked via VT: f9f7b0b949c1206c15b9f94702efb6d728988d4ae350748aa481cbf621136260",
|
|
"pattern": "[file:hashes.SHA1 = 'ecc45323e6f8634e1084dee1ed06ec05385ff0b6']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d22-285c-4341-8fef-4732950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:34.000Z",
|
|
"modified": "2015-12-22T14:24:34.000Z",
|
|
"description": "- Xchecked via VT: f9f7b0b949c1206c15b9f94702efb6d728988d4ae350748aa481cbf621136260",
|
|
"pattern": "[file:hashes.MD5 = '07511b07cc53df4a0f781d7d5f1c41c1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d22-177c-458f-87e6-4b62950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:34.000Z",
|
|
"modified": "2015-12-22T14:24:34.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/f9f7b0b949c1206c15b9f94702efb6d728988d4ae350748aa481cbf621136260/analysis/1445876061/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:34Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d23-8850-4b0d-9867-4051950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:35.000Z",
|
|
"modified": "2015-12-22T14:24:35.000Z",
|
|
"description": "- Xchecked via VT: 91d8acd8f3c89b92c39ace385a67ac992fae5e56cf8f8c73b8b02e4e4c58deff",
|
|
"pattern": "[file:hashes.SHA1 = '85a4bf4a77ee71a6c4fcde55086c0987ea1fa52d']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d23-1680-4f72-b9ca-49cc950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:35.000Z",
|
|
"modified": "2015-12-22T14:24:35.000Z",
|
|
"description": "- Xchecked via VT: 91d8acd8f3c89b92c39ace385a67ac992fae5e56cf8f8c73b8b02e4e4c58deff",
|
|
"pattern": "[file:hashes.MD5 = 'cc8895761120be76bce62a1ae97ca175']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d23-af3c-427a-ba02-4370950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:35.000Z",
|
|
"modified": "2015-12-22T14:24:35.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/91d8acd8f3c89b92c39ace385a67ac992fae5e56cf8f8c73b8b02e4e4c58deff/analysis/1445873923/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d23-c078-4ea0-9db1-4ed5950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:35.000Z",
|
|
"modified": "2015-12-22T14:24:35.000Z",
|
|
"description": "- Xchecked via VT: 9eb68bd28de11fdfb397ba67605c3924d8d32e2ee5473209311ca608f212d4c2",
|
|
"pattern": "[file:hashes.SHA1 = '43b6981ece2643775e49eeb46153bb0a8117edb5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:35Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d24-df78-4dca-b4e2-46ca950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:36.000Z",
|
|
"modified": "2015-12-22T14:24:36.000Z",
|
|
"description": "- Xchecked via VT: 9eb68bd28de11fdfb397ba67605c3924d8d32e2ee5473209311ca608f212d4c2",
|
|
"pattern": "[file:hashes.MD5 = '3cfc854e0cf19a9f609a89b0e8d2cf43']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d24-c808-4c85-9eb2-4620950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:36.000Z",
|
|
"modified": "2015-12-22T14:24:36.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/9eb68bd28de11fdfb397ba67605c3924d8d32e2ee5473209311ca608f212d4c2/analysis/1442432156/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d24-4750-4bea-b915-49b6950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:36.000Z",
|
|
"modified": "2015-12-22T14:24:36.000Z",
|
|
"description": "- Xchecked via VT: 94a4809a3ba8d40407c7d1f0cfc0b84446fa417a624043bb621879b42832108c",
|
|
"pattern": "[file:hashes.SHA1 = '27f6494ff90c37feb416b9fc5c5fabdaf3280181']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:36Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d25-4580-4cb8-8e24-47f5950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:37.000Z",
|
|
"modified": "2015-12-22T14:24:37.000Z",
|
|
"description": "- Xchecked via VT: 94a4809a3ba8d40407c7d1f0cfc0b84446fa417a624043bb621879b42832108c",
|
|
"pattern": "[file:hashes.MD5 = 'eaacfd8c9fac172119a2688270500ab5']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d25-a9bc-4e6d-89c2-4dd7950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:37.000Z",
|
|
"modified": "2015-12-22T14:24:37.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/94a4809a3ba8d40407c7d1f0cfc0b84446fa417a624043bb621879b42832108c/analysis/1448630894/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d25-17c8-451f-882f-4a4c950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:37.000Z",
|
|
"modified": "2015-12-22T14:24:37.000Z",
|
|
"description": "- Xchecked via VT: 9d7dbb4de40e0ef8867500988653cea03fa89a0c62dcc56a3739327f8a24d504",
|
|
"pattern": "[file:hashes.SHA1 = 'e0057fbede771456c7138980f19616a22df1b24e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d25-d96c-4b2a-8a0d-4f1c950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:37.000Z",
|
|
"modified": "2015-12-22T14:24:37.000Z",
|
|
"description": "- Xchecked via VT: 9d7dbb4de40e0ef8867500988653cea03fa89a0c62dcc56a3739327f8a24d504",
|
|
"pattern": "[file:hashes.MD5 = 'e83d83761416742ab69baf379f2b34dd']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:37Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d26-5e30-446a-a97d-4624950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:38.000Z",
|
|
"modified": "2015-12-22T14:24:38.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/9d7dbb4de40e0ef8867500988653cea03fa89a0c62dcc56a3739327f8a24d504/analysis/1445835674/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d26-b91c-460d-9e7d-4a21950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:38.000Z",
|
|
"modified": "2015-12-22T14:24:38.000Z",
|
|
"description": "- Xchecked via VT: 07f29192a339791a997c1a58ba58fa24dff31a60924110a610ed04cd691dac80",
|
|
"pattern": "[file:hashes.SHA1 = '356b146eb5fd671dc3f31e1d5d41672064e3bd00']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d26-b2dc-4452-bbde-436e950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:38.000Z",
|
|
"modified": "2015-12-22T14:24:38.000Z",
|
|
"description": "- Xchecked via VT: 07f29192a339791a997c1a58ba58fa24dff31a60924110a610ed04cd691dac80",
|
|
"pattern": "[file:hashes.MD5 = '1c9bbcf617414a42837db581abdf6d2c']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:38Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d27-1c30-4727-8611-436d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:39.000Z",
|
|
"modified": "2015-12-22T14:24:39.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/07f29192a339791a997c1a58ba58fa24dff31a60924110a610ed04cd691dac80/analysis/1450024122/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d27-8ed4-47b3-8f9c-418a950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:39.000Z",
|
|
"modified": "2015-12-22T14:24:39.000Z",
|
|
"description": "- Xchecked via VT: 7cdf57eca5220399c45ddb92eed4bf1ac879ef4dbf150cba190b546b77b50357",
|
|
"pattern": "[file:hashes.SHA1 = 'b7825f6aacb14bad987294eb244713937f331151']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d27-99e0-478d-a394-4aea950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:39.000Z",
|
|
"modified": "2015-12-22T14:24:39.000Z",
|
|
"description": "- Xchecked via VT: 7cdf57eca5220399c45ddb92eed4bf1ac879ef4dbf150cba190b546b77b50357",
|
|
"pattern": "[file:hashes.MD5 = 'f2393a0b0fc3a23ee43e7f9802d1fa19']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:39Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d28-4fe8-41e3-b25e-4124950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:40.000Z",
|
|
"modified": "2015-12-22T14:24:40.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/7cdf57eca5220399c45ddb92eed4bf1ac879ef4dbf150cba190b546b77b50357/analysis/1444930558/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d28-1d48-4669-a7b8-49aa950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:40.000Z",
|
|
"modified": "2015-12-22T14:24:40.000Z",
|
|
"description": "- Xchecked via VT: 3ab0beaf860e12b318f97dfdc629c066e71b0891e1bfd92473db82b86cc93012",
|
|
"pattern": "[file:hashes.SHA1 = 'dc7cb949b66b531802a97566cc9b2c64c2f4218b']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d28-cc00-42b7-8ec8-4488950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:40.000Z",
|
|
"modified": "2015-12-22T14:24:40.000Z",
|
|
"description": "- Xchecked via VT: 3ab0beaf860e12b318f97dfdc629c066e71b0891e1bfd92473db82b86cc93012",
|
|
"pattern": "[file:hashes.MD5 = 'cbd198f3856a0dd386fe9402e4f265e1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d28-9c10-4172-9329-42c1950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:40.000Z",
|
|
"modified": "2015-12-22T14:24:40.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/3ab0beaf860e12b318f97dfdc629c066e71b0891e1bfd92473db82b86cc93012/analysis/1450262874/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:40Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d29-9454-40a3-a5ed-493e950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:41.000Z",
|
|
"modified": "2015-12-22T14:24:41.000Z",
|
|
"description": "- Xchecked via VT: b566239fc3854276619d7c0c157b837fcda02b6878014549f524de4c89f57b37",
|
|
"pattern": "[file:hashes.SHA1 = '4bbe654bb6ccc41e4b669137c21275bd56e99a4e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"sha1\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d29-5a44-4d55-b836-450d950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:41.000Z",
|
|
"modified": "2015-12-22T14:24:41.000Z",
|
|
"description": "- Xchecked via VT: b566239fc3854276619d7c0c157b837fcda02b6878014549f524de4c89f57b37",
|
|
"pattern": "[file:hashes.MD5 = '90a645be9c632ef4a10dcba031c68cc1']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "Payload delivery"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"md5\"",
|
|
"misp:category=\"Payload delivery\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--56795d29-2da0-4ee3-8e8e-4aaf950d210f",
|
|
"created_by_ref": "identity--55f6ea5f-fd34-43b8-ac1d-40cb950d210f",
|
|
"created": "2015-12-22T14:24:41.000Z",
|
|
"modified": "2015-12-22T14:24:41.000Z",
|
|
"pattern": "[url:value = 'https://www.virustotal.com/file/b566239fc3854276619d7c0c157b837fcda02b6878014549f524de4c89f57b37/analysis/1450021923/']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2015-12-22T14:24:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "External analysis"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |