adulau/misp-circl-feed
1
0
Fork 0
Code Issues Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf.json

294 lines
No EOL
13 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:46:52.000Z",
"modified": "2019-01-16T22:46:52.000Z",
"name": "VK-Intel",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5c3c4a6d-15f0-4133-baff-3c2c68f8e8cf",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:46:52.000Z",
"modified": "2019-01-16T22:46:52.000Z",
"name": "2019-01-10: North Korea Lazarus Targeting REDBANC",
"published": "2024-09-20T18:33:34Z",
"object_refs": [
"indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
"indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
"indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
"indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
"indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
"indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
"indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05",
"observed-data--5c3fb3e5-b7ac-4d04-a6cc-793e0a3d6266",
"domain-name--5c3fb3e5-b7ac-4d04-a6cc-793e0a3d6266",
"observed-data--5c3fb411-e420-441c-92ff-62330a3d6266",
"domain-name--5c3fb411-e420-441c-92ff-62330a3d6266"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"Actor: Lazarus",
"Ruse: Job Application",
"Powershell",
"PowerRatankba",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Trusted Relationship - T1199\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scripting - T1064\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Scheduled Task - T1053\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Windows Management Instrumentation - T1047\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"New Service - T1050\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data from Local System - T1005\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Exfiltration Over Command and Control Channel - T1041\"",
"misp-galaxy:mitre-enterprise-attack-attack-pattern=\"Data Encoding - T1132\"",
"report:5ZvWjgDgRhuD1zVgDT7-cg",
"misp:confidence-level=\"fairly-confident\"",
"misp:threat-level=\"medium-risk\"",
"CTIA-kill-chain:Payload",
"CTIA-kill-chain:C2"
],
"confidence": 50,
"object_marking_refs": [
"marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3c4a99-8830-4833-81d5-3c3068f8e8cf",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-14T08:38:49.000Z",
"modified": "2019-01-14T08:38:49.000Z",
"description": "Malware Hash",
"pattern": "[file:hashes.SHA256 = 'f12db45c32bda3108adb8ae7363c342fdd5f10342945b115d830701f95c54fa9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-14T08:38:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3c4a99-9a68-4e6c-a9a4-3c3068f8e8cf",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-14T08:38:49.000Z",
"modified": "2019-01-14T08:38:49.000Z",
"description": "Malware Hash",
"pattern": "[file:hashes.SHA256 = '0f56ebca33efe0a2755d3b380167e1f5eab4e6180518c03b28d5cffd5b675d26']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-14T08:38:49Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3ca28f-cb88-44d1-a7ce-382d68f8e8cf",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:46:32.000Z",
"modified": "2019-01-16T22:46:32.000Z",
"description": "C2",
"pattern": "[url:value = 'https://ecombox.store']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-16T22:46:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"CTIA-kill-chain:C2"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3ca80f-b398-47e5-b633-124a0a640c05",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-14T15:17:35.000Z",
"modified": "2019-01-14T15:17:35.000Z",
"description": "apt_possible_lazarus_powerratankba_b",
"pattern": "[rule apt_possible_lazarus_powerratankba_b {\r\n meta:\r\n description = \"Detects possible Lazarus PowerRatankba.B from Redbanc\"\r\n author = \"@VK_Intel\"\r\n date = \"2019-01-15\"\r\n hash1 = \"db8163d054a35522d0dec35743cfd2c9872e0eb446467b573a79f84d61761471\"\r\n strings:\r\n $f0 = \"function EncryptDES\" fullword ascii\r\n $s0 = \"$ProID = Start-Process powershell.exe -PassThru -WindowStyle Hidden -ArgumentList\" fullword ascii\r\n $s1 = \"$respTxt = HttpRequestFunc_doprocess -szURI $szFullURL -szMethod $szMethod -contentData $contentData;\" fullword ascii\r\n $s2 = \"$cmdSchedule = 'schtasks /create /tn \\\"ProxyServerUpdater\\\"\" ascii\r\n $s3 = \"/tr \\\"powershell.exe -ep bypass -windowstyle hidden -file \" ascii\r\n $s4 = \"C:\\\\\\\\Users\\\\\\\\Public\\\\\\\\Documents\\\\\\\\tmp' + -join \" ascii\r\n $s5 = \"$cmdResult = cmd.exe /c $cmdInst | Out-String;\" fullword ascii\r\n $s6 = \"whoami /groups | findstr /c:\\\"S-1-5-32-544\\\"\" fullword ascii\r\n condition:\r\n filesize < 500KB and $f0 and 2 of ($s*) \r\n}]",
"pattern_type": "yara",
"pattern_version": "2.1",
"valid_from": "2019-01-14T15:17:35Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"yara\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3ce1c9-39e4-4b59-90e4-5a350a640c05",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-14T19:23:53.000Z",
"modified": "2019-01-14T19:23:53.000Z",
"description": "Powershell Agent & PowerRatankba",
"pattern": "[file:hashes.SHA256 = 'a1f06d69bd6379e310b10a364d689f21499953fa1118ec699a25072779de5d9b']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-14T19:23:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3ce1c9-4d80-470f-9cfc-5a350a640c05",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-14T19:23:53.000Z",
"modified": "2019-01-14T19:23:53.000Z",
"description": "Powershell Agent & PowerRatankba",
"pattern": "[file:hashes.SHA256 = '20d94f7d8ee2c4367443a930370d5685789762b1d11794810dc0ac6c626ad78e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-14T19:23:53Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload installation"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload installation\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5c3ce207-b7f0-468f-8e5a-5a330a640c05",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:43:07.000Z",
"modified": "2019-01-16T22:43:07.000Z",
"description": "URL C2 backup",
"pattern": "[url:value = 'https://bodyshoppechiropractic.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2019-01-16T22:43:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"url\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\"",
"CTIA-kill-chain:C2"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5c3fb3e5-b7ac-4d04-a6cc-793e0a3d6266",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:46:43.000Z",
"modified": "2019-01-16T22:46:43.000Z",
"first_observed": "2019-01-16T22:46:43Z",
"last_observed": "2019-01-16T22:46:43Z",
"number_observed": 1,
"object_refs": [
"domain-name--5c3fb3e5-b7ac-4d04-a6cc-793e0a3d6266"
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"CTIA-kill-chain:C2"
]
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--5c3fb3e5-b7ac-4d04-a6cc-793e0a3d6266",
"value": "bodyshoppechiropractic.com"
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5c3fb411-e420-441c-92ff-62330a3d6266",
"created_by_ref": "identity--5bfa439e-c978-4dcd-b474-73f568f8e8cf",
"created": "2019-01-16T22:46:52.000Z",
"modified": "2019-01-16T22:46:52.000Z",
"first_observed": "2019-01-16T22:46:52Z",
"last_observed": "2019-01-16T22:46:52Z",
"number_observed": 1,
"object_refs": [
"domain-name--5c3fb411-e420-441c-92ff-62330a3d6266"
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"CTIA-kill-chain:C2"
]
},
{
"type": "domain-name",
"spec_version": "2.1",
"id": "domain-name--5c3fb411-e420-441c-92ff-62330a3d6266",
"value": "ecombox.store"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--34098fce-860f-48ae-8e50-ebd3cc5e41da",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:GREEN",
"definition": {
"tlp": "green"
}
}
]
}
Reference in a new issue View git blame Copy permalink