1173 lines
No EOL
52 KiB
JSON
1173 lines
No EOL
52 KiB
JSON
{
|
|
"type": "bundle",
|
|
"id": "bundle--5bf26a1e-c40c-4977-92bf-49b5950d210f",
|
|
"objects": [
|
|
{
|
|
"type": "identity",
|
|
"spec_version": "2.1",
|
|
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T20:45:10.000Z",
|
|
"modified": "2018-11-23T20:45:10.000Z",
|
|
"name": "CIRCL",
|
|
"identity_class": "organization"
|
|
},
|
|
{
|
|
"type": "report",
|
|
"spec_version": "2.1",
|
|
"id": "report--5bf26a1e-c40c-4977-92bf-49b5950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T20:45:10.000Z",
|
|
"modified": "2018-11-23T20:45:10.000Z",
|
|
"name": "OSINT - Analyzing OilRig\u00e2\u20ac\u2122s Ops Tempo from Testing to Weaponization to Delivery",
|
|
"published": "2018-11-23T20:45:44Z",
|
|
"object_refs": [
|
|
"observed-data--5bf26a3e-d790-4108-a5c2-42f3950d210f",
|
|
"url--5bf26a3e-d790-4108-a5c2-42f3950d210f",
|
|
"x-misp-object--5bf26ab1-ed4c-469a-ac83-47bb950d210f",
|
|
"indicator--5bf3dce0-e154-434e-be43-4821950d210f",
|
|
"indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f",
|
|
"indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f",
|
|
"indicator--5bf3e027-58cc-471c-8631-48ca950d210f",
|
|
"indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f",
|
|
"indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f",
|
|
"indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f",
|
|
"indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f",
|
|
"indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f",
|
|
"indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f",
|
|
"indicator--5bf3e138-ff28-42ec-9f56-47c9950d210f",
|
|
"indicator--047611a6-5a28-4b87-b780-294ba4294090",
|
|
"x-misp-object--fda3b99c-dfe0-4a2d-a25c-a090747840f0",
|
|
"indicator--6b9cd6df-e2bc-4e1a-80e9-ee7ffae3118d",
|
|
"x-misp-object--bb78ca9b-0143-46ea-8e86-a073d1c775ef",
|
|
"indicator--269a6029-b0d9-4b40-9e49-a7a3aed9c0d3",
|
|
"x-misp-object--f59ce05a-f1d2-4950-b869-2e92c7fe2868",
|
|
"indicator--42cf5c4b-cf6d-42e3-9087-8c80a04601ca",
|
|
"x-misp-object--a46e4d62-977b-413d-badc-fb6e5c5a0e1c",
|
|
"indicator--e2383a48-9b23-45e2-a84a-ed24c1d37dc9",
|
|
"x-misp-object--51ae8cb9-75a4-4d15-b187-5b090a4c74fd",
|
|
"indicator--4f0b9cf7-862d-4c57-8cca-df5f5a10f03c",
|
|
"x-misp-object--e9b7d750-27c6-4541-a321-fbb1a09f109c",
|
|
"indicator--afa6a24c-5dd6-4442-9ceb-16e2f01a191c",
|
|
"x-misp-object--56446261-9fab-49e6-a549-e29edc190172",
|
|
"indicator--e128e6b0-ac23-4f86-88e1-2bcae21d534f",
|
|
"x-misp-object--c762bc16-95be-413d-9e4f-9acc1062e2ca",
|
|
"indicator--618f6529-fd0f-43f8-94b6-2280c18a4fa7",
|
|
"x-misp-object--e5e043ab-3878-4da7-8bdf-f4d0d40bbe24",
|
|
"indicator--bc15eef6-7731-4ad4-9120-aba92a793716",
|
|
"x-misp-object--ba69395d-29ab-424a-9e69-32e79919b172",
|
|
"indicator--f70d1c99-bb3e-4af6-a1c0-e49a234caaa5",
|
|
"x-misp-object--1f7d2e55-565e-46d2-b577-071d917de53d",
|
|
"relationship--2acdc720-ff3b-47e8-954a-41d44f465262",
|
|
"relationship--7cd98a28-de9c-425a-88c3-e9ff91061b33",
|
|
"relationship--6b16ea2e-c35f-49f3-b824-caf733a1f926",
|
|
"relationship--b564bf90-4a69-4346-afe8-2db9b87c4098",
|
|
"relationship--f4b1fa17-8524-4827-86e7-b55c42971f02",
|
|
"relationship--91a137d4-4592-43f7-a8dd-27a5ccbb87e4",
|
|
"relationship--aa4423bd-904d-42bb-8ea4-619f601bb7a9",
|
|
"relationship--76a8d770-e32b-455e-a548-34384acf463f",
|
|
"relationship--8f78eb92-8ba3-41db-b3c7-be37761d5c64"
|
|
],
|
|
"labels": [
|
|
"Threat-Report",
|
|
"misp:tool=\"MISP-STIX-Converter\"",
|
|
"misp-galaxy:malpedia=\"BONDUPDATER\"",
|
|
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"OilRig\"",
|
|
"misp-galaxy:mitre-intrusion-set=\"OilRig\"",
|
|
"misp-galaxy:threat-actor=\"OilRig\""
|
|
],
|
|
"object_marking_refs": [
|
|
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
|
|
]
|
|
},
|
|
{
|
|
"type": "observed-data",
|
|
"spec_version": "2.1",
|
|
"id": "observed-data--5bf26a3e-d790-4108-a5c2-42f3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-19T07:46:27.000Z",
|
|
"modified": "2018-11-19T07:46:27.000Z",
|
|
"first_observed": "2018-11-19T07:46:27Z",
|
|
"last_observed": "2018-11-19T07:46:27Z",
|
|
"number_observed": 1,
|
|
"object_refs": [
|
|
"url--5bf26a3e-d790-4108-a5c2-42f3950d210f"
|
|
],
|
|
"labels": [
|
|
"misp:type=\"link\"",
|
|
"misp:category=\"External analysis\"",
|
|
"osint:source-type=\"blog-post\""
|
|
]
|
|
},
|
|
{
|
|
"type": "url",
|
|
"spec_version": "2.1",
|
|
"id": "url--5bf26a3e-d790-4108-a5c2-42f3950d210f",
|
|
"value": "https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--5bf26ab1-ed4c-469a-ac83-47bb950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T20:44:35.000Z",
|
|
"modified": "2018-11-23T20:44:35.000Z",
|
|
"labels": [
|
|
"misp:name=\"microblog\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "text",
|
|
"object_relation": "post",
|
|
"value": "Unit 42\u00e2\u20ac\u2122s continued look into #OilRig analyzes the group\u00e2\u20ac\u2122s operational tempo, including testing, weaponization and attack delivery. Get the full report (link: https://researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/) researchcenter.paloaltonetworks.com/2018/11/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/",
|
|
"category": "Other",
|
|
"uuid": "5bf26ab1-f394-4f15-ac6d-4c87950d210f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "type",
|
|
"value": "Twitter",
|
|
"category": "Other",
|
|
"uuid": "5bf26ab2-a9e4-417f-b9f4-4f53950d210f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "url",
|
|
"value": "https://mobile.twitter.com/Unit42_Intel/status/1063461728971907072",
|
|
"category": "External analysis",
|
|
"uuid": "5bf26ab2-ed98-4f18-a4a0-4627950d210f"
|
|
},
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "creation-date",
|
|
"value": "2018-11-16T05:00:00",
|
|
"category": "Other",
|
|
"uuid": "5bf26ab3-a42c-4278-aad5-44db950d210f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "username",
|
|
"value": "@Unit42_Intel",
|
|
"category": "Other",
|
|
"uuid": "5bf26ab3-b264-44e7-b47a-47a2950d210f"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "microblog"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3dce0-e154-434e-be43-4821950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T10:07:45.000Z",
|
|
"modified": "2018-11-20T10:07:45.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T10:07:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:33:41.000Z",
|
|
"modified": "2018-11-20T13:33:41.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:33:41Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:33:27.000Z",
|
|
"modified": "2018-11-20T13:33:27.000Z",
|
|
"pattern": "[file:hashes.SHA256 = 'a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e' AND file:name = 'XLS-withyourface.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:33:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:33:15.000Z",
|
|
"modified": "2018-11-20T13:33:15.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3' AND file:name = 'XLS-withyourface \u00e2\u20ac\u201c test.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:33:15Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:32:45.000Z",
|
|
"modified": "2018-11-20T13:32:45.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:32:45Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:32:26.000Z",
|
|
"modified": "2018-11-20T13:32:26.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:32:26Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:32:06.000Z",
|
|
"modified": "2018-11-20T13:32:06.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:32:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:31:49.000Z",
|
|
"modified": "2018-11-20T13:31:49.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56' AND file:name = 'sss.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:31:49Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:31:20.000Z",
|
|
"modified": "2018-11-20T13:31:20.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633' AND file:name = 'sss \u00e2\u20ac\u201c Copy.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:31:20Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T13:30:58.000Z",
|
|
"modified": "2018-11-20T13:30:58.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702' AND file:name = 'sss \u00e2\u20ac\u201c Copy.xls' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T13:30:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--5bf3e138-ff28-42ec-9f56-47c9950d210f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-20T10:26:00.000Z",
|
|
"modified": "2018-11-20T10:26:00.000Z",
|
|
"pattern": "[file:hashes.SHA256 = '7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00' AND file:name = 'N56.15.doc' AND file:x_misp_state = 'Malicious']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-20T10:26:00Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--047611a6-5a28-4b87-b780-294ba4294090",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:14:52.000Z",
|
|
"modified": "2018-11-23T09:14:52.000Z",
|
|
"pattern": "[file:hashes.MD5 = '7d08fd0f5abe8c928d223c592e961274' AND file:hashes.SHA1 = '4b84d94d957695b9bb097dd32d17858412f6c68e' AND file:hashes.SHA256 = '66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:14:52Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--fda3b99c-dfe0-4a2d-a25c-a090747840f0",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:14:53.000Z",
|
|
"modified": "2018-11-23T09:14:53.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:49",
|
|
"category": "Other",
|
|
"uuid": "a6713e81-cb73-4896-8a19-a64faa51c558"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/66d678b097a2245f60f3d95bb608f3958aa0f5f19ca7e5853f38ea79885b9633/analysis/1542707989/",
|
|
"category": "External analysis",
|
|
"uuid": "2bf87a9e-e60c-41d7-ab40-b4b91edbc40f"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/59",
|
|
"category": "Other",
|
|
"uuid": "6cd2ece3-1b96-478f-808e-885dfafb0d85"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--6b9cd6df-e2bc-4e1a-80e9-ee7ffae3118d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:14:54.000Z",
|
|
"modified": "2018-11-23T09:14:54.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ec94c2102c727f9e2707143d81bc5555' AND file:hashes.SHA1 = '4182f8ccc24d18643c55ad2bb140a69022ff6b8c' AND file:hashes.SHA256 = '6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:14:54Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--bb78ca9b-0143-46ea-8e86-a073d1c775ef",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:14:57.000Z",
|
|
"modified": "2018-11-23T09:14:57.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:43",
|
|
"category": "Other",
|
|
"uuid": "f9d9ba58-0c08-4fa8-bd2f-84c8d10074f4"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/6f522b1be1f2b6642c292bb3fb57f523ebedeb04f0d18efa2a283e79f3689a9f/analysis/1542707983/",
|
|
"category": "External analysis",
|
|
"uuid": "b1a901cd-3a99-485c-a074-7938e7ad9282"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "39/58",
|
|
"category": "Other",
|
|
"uuid": "4f1ed999-43b2-4fe5-b91c-3beece0924f1"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--269a6029-b0d9-4b40-9e49-a7a3aed9c0d3",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:14:58.000Z",
|
|
"modified": "2018-11-23T09:14:58.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'fb854cc448f60ca750cd7bf3486db11b' AND file:hashes.SHA1 = '857a1819a3cc1fd650165fe1a0d7b6dab16171c8' AND file:hashes.SHA256 = '687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:14:58Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--f59ce05a-f1d2-4950-b869-2e92c7fe2868",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:00.000Z",
|
|
"modified": "2018-11-23T09:15:00.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:47",
|
|
"category": "Other",
|
|
"uuid": "d18566f2-e6c7-43f8-be02-94e538a1b200"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/687027d966667780ab786635b0d4274b651f27d99717c5ba95e139e94ef114c3/analysis/1542707987/",
|
|
"category": "External analysis",
|
|
"uuid": "8ef6f840-97e8-46fe-9566-7f94fc6d9536"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "36/59",
|
|
"category": "Other",
|
|
"uuid": "60e3774e-fde8-49b6-88c0-b2b85aab1e0a"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--42cf5c4b-cf6d-42e3-9087-8c80a04601ca",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:02.000Z",
|
|
"modified": "2018-11-23T09:15:02.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'aa7c9cc7063d4e541246034485fc114e' AND file:hashes.SHA1 = 'f390069d7e72300acbf5171a70a6c512ac9dfc92' AND file:hashes.SHA256 = '364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:02Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--a46e4d62-977b-413d-badc-fb6e5c5a0e1c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:04.000Z",
|
|
"modified": "2018-11-23T09:15:04.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:48",
|
|
"category": "Other",
|
|
"uuid": "f4b018ee-9d3c-452f-bc71-9b84beac52cf"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/364e2884251c151a29071a5975ca0076405a8cc2bab8da3e784491632ec07f56/analysis/1542707988/",
|
|
"category": "External analysis",
|
|
"uuid": "ae7753b3-514a-406f-a5d6-1c95a3eed682"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "36/58",
|
|
"category": "Other",
|
|
"uuid": "123f8af4-c44b-41ed-8bc2-9ef2f6989a42"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e2383a48-9b23-45e2-a84a-ed24c1d37dc9",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:06.000Z",
|
|
"modified": "2018-11-23T09:15:06.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'd93927f31afa691bc0d1107ab28fc0f1' AND file:hashes.SHA1 = '4534a9e6c1b1c83929df0a107976432d1bef781e' AND file:hashes.SHA256 = '70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:06Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--51ae8cb9-75a4-4d15-b187-5b090a4c74fd",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:09.000Z",
|
|
"modified": "2018-11-23T09:15:09.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:50",
|
|
"category": "Other",
|
|
"uuid": "b02a459d-edb2-4a4b-bf00-5ed634e74a81"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/70ff20f2e5c7fd90c6bfe92e28df585f711ee4090fc7669b3a9bd024c4e11702/analysis/1542707990/",
|
|
"category": "External analysis",
|
|
"uuid": "4c7c9ecd-7ded-4f6a-85d3-e9468d620cf3"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "33/58",
|
|
"category": "Other",
|
|
"uuid": "9bd6849a-911f-4881-abd8-fa766d220bf9"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--4f0b9cf7-862d-4c57-8cca-df5f5a10f03c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:12.000Z",
|
|
"modified": "2018-11-23T09:15:12.000Z",
|
|
"pattern": "[file:hashes.MD5 = '10e1387eb09286518db5cc22b763a3fd' AND file:hashes.SHA1 = 'd517425ff63b929755a023cd2ab04db4174511b2' AND file:hashes.SHA256 = '216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:12Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e9b7d750-27c6-4541-a321-fbb1a09f109c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:14.000Z",
|
|
"modified": "2018-11-23T09:15:14.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:46",
|
|
"category": "Other",
|
|
"uuid": "466fa265-7cbc-4676-85af-49f0f6cdba76"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/216ffed357b5fe4d71848c79f77716e9ecebdd010666cdb9edaadf7a8c9ec576/analysis/1542707986/",
|
|
"category": "External analysis",
|
|
"uuid": "2c32669a-46af-44b6-a0c4-4d060ab92fa6"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "35/59",
|
|
"category": "Other",
|
|
"uuid": "6cb17ee7-fb52-4fd1-8b91-9475cb2694dd"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--afa6a24c-5dd6-4442-9ceb-16e2f01a191c",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:16.000Z",
|
|
"modified": "2018-11-23T09:15:16.000Z",
|
|
"pattern": "[file:hashes.MD5 = '52b6e1ef0d079f4c2572705156365c06' AND file:hashes.SHA1 = '5732b44851ec10f16c8e1201af3bec455f724961' AND file:hashes.SHA256 = '7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:16Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--56446261-9fab-49e6-a549-e29edc190172",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:18.000Z",
|
|
"modified": "2018-11-23T09:15:18.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:50",
|
|
"category": "Other",
|
|
"uuid": "02482eed-8c8d-442b-a20b-ffda43ede01f"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/7cbad6b3f505a199d6766a86b41ed23786bbb99dab9cae6c18936afdc2512f00/analysis/1542707990/",
|
|
"category": "External analysis",
|
|
"uuid": "340cf732-cbec-4574-a76d-601543efd766"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "39/58",
|
|
"category": "Other",
|
|
"uuid": "feb1c47b-754f-4d6f-ba9d-1960e7fa9203"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--e128e6b0-ac23-4f86-88e1-2bcae21d534f",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:19.000Z",
|
|
"modified": "2018-11-23T09:15:19.000Z",
|
|
"pattern": "[file:hashes.MD5 = '11bf5c50f45b9c8aca1d86ae2e2aec44' AND file:hashes.SHA1 = 'c04c44d0b44f79a6d46799e0db999add0457d24b' AND file:hashes.SHA256 = 'a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:19Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--c762bc16-95be-413d-9e4f-9acc1062e2ca",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:20.000Z",
|
|
"modified": "2018-11-23T09:15:20.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:44",
|
|
"category": "Other",
|
|
"uuid": "d61dc799-8a36-44e4-a8ec-7614ab44609c"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/a5bec7573b743932329b794042f38571dd91731ae50757317bdaf9e820ec8d5e/analysis/1542707984/",
|
|
"category": "External analysis",
|
|
"uuid": "ea090e3d-20b3-40ac-bf60-ed36cdbde852"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "29/58",
|
|
"category": "Other",
|
|
"uuid": "d8ad0eaa-ac87-4cdc-9f2c-989f3a82db71"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--618f6529-fd0f-43f8-94b6-2280c18a4fa7",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:21.000Z",
|
|
"modified": "2018-11-23T09:15:21.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'ac685796da5c02bec61c2909867892ad' AND file:hashes.SHA1 = '8aff94d7eaf14d1b28f15cbe239cbc6b7882172c' AND file:hashes.SHA256 = '6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:21Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--e5e043ab-3878-4da7-8bdf-f4d0d40bbe24",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:23.000Z",
|
|
"modified": "2018-11-23T09:15:23.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-22T12:29:55",
|
|
"category": "Other",
|
|
"uuid": "05a067d9-e5b3-4042-909a-5319a369675e"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/6719e80361950cdb10c4a4fcccc389c2a26eaab761c202870353fe65e8f954a3/analysis/1542889795/",
|
|
"category": "External analysis",
|
|
"uuid": "21fe45d8-52fc-47b9-8a99-647d89f6e835"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/59",
|
|
"category": "Other",
|
|
"uuid": "d196ac6e-909d-4cec-86b3-57aa476147d6"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--bc15eef6-7731-4ad4-9120-aba92a793716",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:24.000Z",
|
|
"modified": "2018-11-23T09:15:24.000Z",
|
|
"pattern": "[file:hashes.MD5 = 'c99df7fbff1bf73f818e6ab9d008a37c' AND file:hashes.SHA1 = '0eea9b6501bcd788d63f783690e6fc8e7f842377' AND file:hashes.SHA256 = '9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:24Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--ba69395d-29ab-424a-9e69-32e79919b172",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:25.000Z",
|
|
"modified": "2018-11-23T09:15:25.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:44",
|
|
"category": "Other",
|
|
"uuid": "0041407e-fa19-4e11-bea9-377951552df3"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/9b6ebc44e4452d8c53c21b0fdd8311bac10dc672309b67d7f214fbd2a08962ce/analysis/1542707984/",
|
|
"category": "External analysis",
|
|
"uuid": "e81e8285-d90c-4e15-9454-cd514b261c1e"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/58",
|
|
"category": "Other",
|
|
"uuid": "fa4f0d34-61ee-4697-aaea-3f67ae251764"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "indicator",
|
|
"spec_version": "2.1",
|
|
"id": "indicator--f70d1c99-bb3e-4af6-a1c0-e49a234caaa5",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:27.000Z",
|
|
"modified": "2018-11-23T09:15:27.000Z",
|
|
"pattern": "[file:hashes.MD5 = '8fec2d11642f8d6c5fc25839c6739fc3' AND file:hashes.SHA1 = 'd2ce79b276e4ae0538e2ba168284425eaa709046' AND file:hashes.SHA256 = '056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa']",
|
|
"pattern_type": "stix",
|
|
"pattern_version": "2.1",
|
|
"valid_from": "2018-11-23T09:15:27Z",
|
|
"kill_chain_phases": [
|
|
{
|
|
"kill_chain_name": "misp-category",
|
|
"phase_name": "file"
|
|
}
|
|
],
|
|
"labels": [
|
|
"misp:name=\"file\"",
|
|
"misp:meta-category=\"file\"",
|
|
"misp:to_ids=\"True\""
|
|
]
|
|
},
|
|
{
|
|
"type": "x-misp-object",
|
|
"spec_version": "2.1",
|
|
"id": "x-misp-object--1f7d2e55-565e-46d2-b577-071d917de53d",
|
|
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
|
|
"created": "2018-11-23T09:15:28.000Z",
|
|
"modified": "2018-11-23T09:15:28.000Z",
|
|
"labels": [
|
|
"misp:name=\"virustotal-report\"",
|
|
"misp:meta-category=\"misc\""
|
|
],
|
|
"x_misp_attributes": [
|
|
{
|
|
"type": "datetime",
|
|
"object_relation": "last-submission",
|
|
"value": "2018-11-20T09:59:46",
|
|
"category": "Other",
|
|
"uuid": "371753f9-4742-452e-83ff-9300b1d34c79"
|
|
},
|
|
{
|
|
"type": "link",
|
|
"object_relation": "permalink",
|
|
"value": "https://www.virustotal.com/file/056ffc13a7a2e944f7ab8c99ea9a2d1b429bbafa280eb2043678aa8b259999aa/analysis/1542707986/",
|
|
"category": "External analysis",
|
|
"uuid": "71c1cb17-164a-43be-afcf-5ad78c11b409"
|
|
},
|
|
{
|
|
"type": "text",
|
|
"object_relation": "detection-ratio",
|
|
"value": "37/58",
|
|
"category": "Other",
|
|
"uuid": "701771f6-7ca6-4ab0-a213-d030b083d7ad"
|
|
}
|
|
],
|
|
"x_misp_meta_category": "misc",
|
|
"x_misp_name": "virustotal-report"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--2acdc720-ff3b-47e8-954a-41d44f465262",
|
|
"created": "2018-11-20T13:33:41.000Z",
|
|
"modified": "2018-11-20T13:33:41.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f",
|
|
"target_ref": "indicator--5bf3dce0-e154-434e-be43-4821950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--7cd98a28-de9c-425a-88c3-e9ff91061b33",
|
|
"created": "2018-11-20T13:33:27.000Z",
|
|
"modified": "2018-11-20T13:33:27.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f",
|
|
"target_ref": "indicator--5bf3dd1a-cf70-4592-8837-4dfe950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--6b16ea2e-c35f-49f3-b824-caf733a1f926",
|
|
"created": "2018-11-20T13:33:15.000Z",
|
|
"modified": "2018-11-20T13:33:15.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f",
|
|
"target_ref": "indicator--5bf3e00c-bc00-41e7-9b02-4e0f950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--b564bf90-4a69-4346-afe8-2db9b87c4098",
|
|
"created": "2018-11-20T13:32:45.000Z",
|
|
"modified": "2018-11-20T13:32:45.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f",
|
|
"target_ref": "indicator--5bf3e027-58cc-471c-8631-48ca950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--f4b1fa17-8524-4827-86e7-b55c42971f02",
|
|
"created": "2018-11-20T13:32:26.000Z",
|
|
"modified": "2018-11-20T13:32:26.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f",
|
|
"target_ref": "indicator--5bf3e04e-825c-493e-b2a4-cd28950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--91a137d4-4592-43f7-a8dd-27a5ccbb87e4",
|
|
"created": "2018-11-20T13:32:06.000Z",
|
|
"modified": "2018-11-20T13:32:06.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f",
|
|
"target_ref": "indicator--5bf3e072-28e4-42c4-872b-cdc6950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--aa4423bd-904d-42bb-8ea4-619f601bb7a9",
|
|
"created": "2018-11-20T13:31:49.000Z",
|
|
"modified": "2018-11-20T13:31:49.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f",
|
|
"target_ref": "indicator--5bf3e08f-0098-43ae-adf0-ae40950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--76a8d770-e32b-455e-a548-34384acf463f",
|
|
"created": "2018-11-20T13:31:20.000Z",
|
|
"modified": "2018-11-20T13:31:20.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f",
|
|
"target_ref": "indicator--5bf3e0b6-e390-4e6b-8f2c-4cc3950d210f"
|
|
},
|
|
{
|
|
"type": "relationship",
|
|
"spec_version": "2.1",
|
|
"id": "relationship--8f78eb92-8ba3-41db-b3c7-be37761d5c64",
|
|
"created": "2018-11-20T13:30:58.000Z",
|
|
"modified": "2018-11-20T13:30:58.000Z",
|
|
"relationship_type": "derived-from",
|
|
"source_ref": "indicator--5bf3e108-46f4-4b78-ae55-4d29950d210f",
|
|
"target_ref": "indicator--5bf3e0e5-eb78-4359-9884-4e4a950d210f"
|
|
},
|
|
{
|
|
"type": "marking-definition",
|
|
"spec_version": "2.1",
|
|
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
|
|
"created": "2017-01-20T00:00:00.000Z",
|
|
"definition_type": "tlp",
|
|
"name": "TLP:WHITE",
|
|
"definition": {
|
|
"tlp": "white"
|
|
}
|
|
}
|
|
]
|
|
} |