adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/276f7055-c5e0-4b14-8645-c7028d0c74aa.json

157 lines
No EOL
7.9 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--276f7055-c5e0-4b14-8645-c7028d0c74aa",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:44:54.000Z",
"modified": "2023-11-21T15:44:54.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--276f7055-c5e0-4b14-8645-c7028d0c74aa",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:44:54.000Z",
"modified": "2023-11-21T15:44:54.000Z",
"name": "BiBi-Linux: A New Wiper Dropped By Pro-Hamas Hacktivist Group",
"published": "2023-11-21T15:45:22Z",
"object_refs": [
"indicator--c00c5b6f-29b8-447f-a3f0-030ff96853aa",
"x-misp-object--6b711ec1-b53c-48f5-8436-50388d503f55",
"indicator--b9746ab6-34ac-4d64-9a17-f42c542ecb5f",
"indicator--6219119e-914a-4bb2-b30e-422fed8d3f4b"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"type:OSINT",
"osint:lifetime=\"perpetual\"",
"osint:certainty=\"50\"",
"tlp:clear",
"misp-galaxy:country=\"israel\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c00c5b6f-29b8-447f-a3f0-030ff96853aa",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:24:32.000Z",
"modified": "2023-11-21T15:24:32.000Z",
"pattern": "[file:hashes.SHA256 = '23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-11-21T15:24:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Payload delivery"
}
],
"labels": [
"misp:type=\"sha256\"",
"misp:category=\"Payload delivery\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--6b711ec1-b53c-48f5-8436-50388d503f55",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:24:44.000Z",
"modified": "2023-11-21T15:24:44.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/gui/file/23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad",
"category": "External analysis",
"uuid": "c9e9a95d-26dd-404e-a526-c6494f963be3"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "38/63",
"category": "Other",
"uuid": "c1ccaba3-d7cb-4275-be5b-48976a54104c"
}
],
"x_misp_comment": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b9746ab6-34ac-4d64-9a17-f42c542ecb5f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:24:44.000Z",
"modified": "2023-11-21T15:24:44.000Z",
"description": "23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad: Enriched via the virustotal module",
"pattern": "[file:hashes.MD5 = 'de9da4fcfb8320b9d34239effce1871a' AND file:hashes.SHA1 = '0dbabdc1ae8c3c8a48224ee3c3e8b6a17f41d6e7' AND file:hashes.SHA256 = '23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad' AND file:hashes.SSDEEP = '12288:S9Xgj1wC07PZOqLNj6rcTl9VZynUG6HHWxDMG4sTcaQNS8DfYX:SWj6R7PZOqLN8cTl9VZYUbgqfY' AND file:hashes.VHASH = 'e55425d7c7ad5e18ddaa4e29cf9aa676' AND file:x_misp_tlsh = 't1e8452a17bea354fdc1a6d4344b5bc5f3ac2478944321393b3295db312ea6e200b6dbb9']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2023-11-21T15:24:44Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--6219119e-914a-4bb2-b30e-422fed8d3f4b",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2023-11-21T15:27:17.000Z",
"modified": "2023-11-21T15:27:17.000Z",
"name": "MAL_WIPER_BiBi_Oct23",
"pattern": "rule MAL_WIPER_BiBi_Oct23 {\r\n meta:\r\n description = \\\\\"Detects BiBi wiper samples for Windows and Linux\\\\\"\r\n author = \\\\\"Florian Roth\\\\\"\r\n reference = \\\\\"https://x.com/ESETresearch/status/1719437301900595444?s=20\\\\\"\r\n date = \\\\\"2023-11-01\\\\\"\r\n hash1 = \\\\\"23bae09b5699c2d5c4cb1b8aa908a3af898b00f88f06e021edcb16d7d558efad\\\\\"\r\n hash2 = \\\\\"40417e937cd244b2f928150cae6fa0eff5551fdb401ea072f6ecdda67a747e17\\\\\"\r\n strings:\r\n $s1 = \\\\\"send attempt while closed\\\\\" ascii fullword\r\n $s2 = \\\\\"[+] CPU cores: \\\\%d, Threads: \\\\%d\\\\\" ascii fullword\r\n $s3 = \\\\\"[+] Stats: \\\\%d | \\\\%d\\\\\" ascii fullword\r\n\r\n $opw1 = { 33 c0 88 45 48 b8 01 00 00 00 86 45 48 45 8b f5 48 8d 3d de f5 ff ff 0f 57 c9 f3 0f 7f 4d b8 }\r\n $opw2 = { 2d ce b5 00 00 c5 fa e6 f5 e9 40 fe ff ff 0f 1f 44 00 00 75 2e c5 fb 10 0d 26 b4 00 00 44 8b 05 5f b6 00 00 e8 ca 0d 00 00 }\r\n\r\n $opl1 = { 4c 8d 44 24 08 48 89 f7 48 ff c2 48 83 c6 04 e8 c7 fb ff ff 41 89 c1 0f b6 42 ff 41 0f af c1 }\r\n $opl2 = { e8 6f fb ff ff 49 8d 78 f8 89 c0 48 01 c2 48 89 15 09 fb 24 00 e8 5a fb ff ff 49 8d 78 fc 6b f0 06 } \r\n condition:\r\n ( uint16(0) == 0x5a4d or uint16(0) == 0x457f )\r\n and filesize < 4000KB\r\n and 2 of them\r\n}",
"pattern_type": "yara",
"pattern_version": "2.1",
"valid_from": "2023-11-21T15:27:17Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "misc"
}
],
"labels": [
"misp:name=\"yara\"",
"misp:meta-category=\"misc\"",
"misp:to_ids=\"True\""
],
"x_misp_context": "all"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink