adulau/misp-circl-feed
1
0
Fork 0
Code Issues 1 Pull requests Projects 1 Releases Packages Wiki Activity Actions
misp-circl-feed/feeds/circl/stix-2.1/5bf26acf-d95c-4892-a05d-4db5950d210f.json

398 lines
No EOL
17 KiB
JSON
Raw Blame History

{
"type": "bundle",
"id": "bundle--5bf26acf-d95c-4892-a05d-4db5950d210f",
"objects": [
{
"type": "identity",
"spec_version": "2.1",
"id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:46.000Z",
"modified": "2018-11-19T14:25:46.000Z",
"name": "CIRCL",
"identity_class": "organization"
},
{
"type": "report",
"spec_version": "2.1",
"id": "report--5bf26acf-d95c-4892-a05d-4db5950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:46.000Z",
"modified": "2018-11-19T14:25:46.000Z",
"name": "OSINT - CozyBear \u00e2\u20ac\u201c In from the Cold?",
"published": "2018-11-19T14:25:52Z",
"object_refs": [
"observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
"url--5bf26c6f-d748-499e-a651-40e3950d210f",
"indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
"indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
"indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
"indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
"indicator--5bf27326-3988-4648-8349-48a8950d210f",
"indicator--5bf27381-7984-4244-933f-402b950d210f",
"indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
"indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
"x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
"indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
"x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
"relationship--cd36167a-f2c6-412e-9f00-294b78d089a7",
"relationship--dc326142-d8f4-48ce-aeda-059ac12d94b1"
],
"labels": [
"Threat-Report",
"misp:tool=\"MISP-STIX-Converter\"",
"misp-galaxy:threat-actor=\"APT 29\"",
"misp-galaxy:mitre-intrusion-set=\"APT29\"",
"misp-galaxy:mitre-malware=\"CozyCar\"",
"misp-galaxy:mitre-enterprise-attack-intrusion-set=\"APT29 - G0016\"",
"misp-galaxy:mitre-enterprise-attack-malware=\"CozyCar\"",
"misp-galaxy:malpedia=\"Cobalt Strike\"",
"misp-galaxy:rat=\"Cobalt Strike\"",
"misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike\"",
"misp-galaxy:mitre-enterprise-attack-tool=\"Cobalt Strike - S0154\"",
"misp-galaxy:mitre-tool=\"Cobalt Strike\"",
"circl:incident-classification=\"phishing\""
],
"object_marking_refs": [
"marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
]
},
{
"type": "observed-data",
"spec_version": "2.1",
"id": "observed-data--5bf26c6f-d748-499e-a651-40e3950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T07:56:20.000Z",
"modified": "2018-11-19T07:56:20.000Z",
"first_observed": "2018-11-19T07:56:20Z",
"last_observed": "2018-11-19T07:56:20Z",
"number_observed": 1,
"object_refs": [
"url--5bf26c6f-d748-499e-a651-40e3950d210f"
],
"labels": [
"misp:type=\"link\"",
"misp:category=\"External analysis\"",
"osint:source-type=\"blog-post\""
]
},
{
"type": "url",
"spec_version": "2.1",
"id": "url--5bf26c6f-d748-499e-a651-40e3950d210f",
"value": "https://pylos.co/2018/11/18/cozybear-in-from-the-cold/"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf27aea-d798-4848-88f8-43a7950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:57:14.000Z",
"modified": "2018-11-19T08:57:14.000Z",
"pattern": "[domain-name:value = 'pandorasong.com']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:57:14Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "Network activity"
}
],
"labels": [
"misp:type=\"domain\"",
"misp:category=\"Network activity\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf26eb3-588c-479a-8c42-48b6950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:05:07.000Z",
"modified": "2018-11-19T08:05:07.000Z",
"description": "mail server",
"pattern": "[domain-name:value = 'mx1.era.citon.com' AND domain-name:resolves_to_refs[*].value = '216.251.161.198']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:05:07Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "network"
}
],
"labels": [
"misp:name=\"domain-ip\"",
"misp:meta-category=\"network\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:07:47.000Z",
"modified": "2018-11-19T08:07:47.000Z",
"pattern": "[file:name = 'ds7002.lnk' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:07:47Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:07:58.000Z",
"modified": "2018-11-19T08:07:58.000Z",
"pattern": "[file:name = 'cyzfc.dat' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:07:58Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf27326-3988-4648-8349-48a8950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:24:06.000Z",
"modified": "2018-11-19T08:24:06.000Z",
"pattern": "[file:name = '7486-the-shocking-truth-about-election-rigging-in-america.rtf.lnk' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:24:06Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf27381-7984-4244-933f-402b950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T08:25:37.000Z",
"modified": "2018-11-19T08:25:37.000Z",
"pattern": "[file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T08:25:37Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--5bf27c25-d538-45b8-be16-44f0950d210f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T09:02:29.000Z",
"modified": "2018-11-19T09:02:29.000Z",
"pattern": "[file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05' AND file:x_misp_state = 'Malicious']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T09:02:29Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--f815afa9-6251-4258-af1c-d3c6354478f9",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:30.000Z",
"modified": "2018-11-19T14:25:30.000Z",
"pattern": "[file:hashes.MD5 = '16bbc967a8b6a365871a05c74a4f345b' AND file:hashes.SHA1 = '9858d5cb2a6614be3c48e33911bf9f7978b441bf' AND file:hashes.SHA256 = 'b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T14:25:30Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--13b82a46-f0a2-4216-b6ff-f15d7e5aa85f",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:31.000Z",
"modified": "2018-11-19T14:25:31.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2018-11-19T03:46:22",
"category": "Other",
"uuid": "17a08ecf-8c7a-44f0-8d62-5610b7f6016b"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/b77ff307ea74a3ab41c92036aea4a049b3c2e69b12a857d26910e535544dfb05/analysis/1542599182/",
"category": "External analysis",
"uuid": "fe091e77-2656-44c2-9dba-067a12240376"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "38/65",
"category": "Other",
"uuid": "38131c5b-7a1f-432f-ae28-1d344e1b044e"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--6c5c8753-80c8-496e-8f41-0c72d76ceceb",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:32.000Z",
"modified": "2018-11-19T14:25:32.000Z",
"pattern": "[file:hashes.MD5 = '6ed0020b0851fb71d5b0076f4ee95f3c' AND file:hashes.SHA1 = 'e431261c63f94a174a1308defccc674dabbe3609' AND file:hashes.SHA256 = '2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2018-11-19T14:25:32Z",
"kill_chain_phases": [
{
"kill_chain_name": "misp-category",
"phase_name": "file"
}
],
"labels": [
"misp:name=\"file\"",
"misp:meta-category=\"file\"",
"misp:to_ids=\"True\""
]
},
{
"type": "x-misp-object",
"spec_version": "2.1",
"id": "x-misp-object--4c234bd0-9fb2-4f60-9e0f-971e8746024d",
"created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
"created": "2018-11-19T14:25:34.000Z",
"modified": "2018-11-19T14:25:34.000Z",
"labels": [
"misp:name=\"virustotal-report\"",
"misp:meta-category=\"misc\""
],
"x_misp_attributes": [
{
"type": "datetime",
"object_relation": "last-submission",
"value": "2018-11-19T03:14:57",
"category": "Other",
"uuid": "fb3ad0e4-c955-44af-93d8-874ab7cd17bd"
},
{
"type": "link",
"object_relation": "permalink",
"value": "https://www.virustotal.com/file/2cea2a1f53dac3f4fff156eacc2ecc8e98b1a64f0f5b5ee1c42c69d9a226c55c/analysis/1542597297/",
"category": "External analysis",
"uuid": "5f7203c2-d42b-46a5-88da-090e96f40841"
},
{
"type": "text",
"object_relation": "detection-ratio",
"value": "22/55",
"category": "Other",
"uuid": "c1f98fdf-637c-4e0e-be43-b1e622dfe8cd"
}
],
"x_misp_meta_category": "misc",
"x_misp_name": "virustotal-report"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cd36167a-f2c6-412e-9f00-294b78d089a7",
"created": "2018-11-19T08:07:46.000Z",
"modified": "2018-11-19T08:07:46.000Z",
"relationship_type": "dropped",
"source_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f",
"target_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dc326142-d8f4-48ce-aeda-059ac12d94b1",
"created": "2018-11-19T08:07:57.000Z",
"modified": "2018-11-19T08:07:57.000Z",
"relationship_type": "dropped-by",
"source_ref": "indicator--5bf26f43-b2c0-4102-8ba0-472a950d210f",
"target_ref": "indicator--5bf26f31-11ec-4a5b-aea4-4fee950d210f"
},
{
"type": "marking-definition",
"spec_version": "2.1",
"id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
"created": "2017-01-20T00:00:00.000Z",
"definition_type": "tlp",
"name": "TLP:WHITE",
"definition": {
"tlp": "white"
}
}
]
}
Reference in a new issue View git blame Copy permalink