983 lines
82 KiB
XML
983 lines
82 KiB
XML
<stix:STIX_Package
|
|
xmlns:cyboxCommon="http://cybox.mitre.org/common-2"
|
|
xmlns:cybox="http://cybox.mitre.org/cybox-2"
|
|
xmlns:cyboxVocabs="http://cybox.mitre.org/default_vocabularies-2"
|
|
xmlns:ASObj="http://cybox.mitre.org/objects#ASObject-1"
|
|
xmlns:AddressObj="http://cybox.mitre.org/objects#AddressObject-2"
|
|
xmlns:DomainNameObj="http://cybox.mitre.org/objects#DomainNameObject-1"
|
|
xmlns:EmailMessageObj="http://cybox.mitre.org/objects#EmailMessageObject-2"
|
|
xmlns:FileObj="http://cybox.mitre.org/objects#FileObject-2"
|
|
xmlns:HTTPSessionObj="http://cybox.mitre.org/objects#HTTPSessionObject-2"
|
|
xmlns:HostnameObj="http://cybox.mitre.org/objects#HostnameObject-1"
|
|
xmlns:MutexObj="http://cybox.mitre.org/objects#MutexObject-2"
|
|
xmlns:PipeObj="http://cybox.mitre.org/objects#PipeObject-2"
|
|
xmlns:URIObj="http://cybox.mitre.org/objects#URIObject-2"
|
|
xmlns:WinRegistryKeyObj="http://cybox.mitre.org/objects#WinRegistryKeyObject-2"
|
|
xmlns:marking="http://data-marking.mitre.org/Marking-1"
|
|
xmlns:tlpMarking="http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1"
|
|
xmlns:et="http://stix.mitre.org/ExploitTarget-1"
|
|
xmlns:incident="http://stix.mitre.org/Incident-1"
|
|
xmlns:indicator="http://stix.mitre.org/Indicator-2"
|
|
xmlns:ttp="http://stix.mitre.org/TTP-1"
|
|
xmlns:ta="http://stix.mitre.org/ThreatActor-1"
|
|
xmlns:stixCommon="http://stix.mitre.org/common-1"
|
|
xmlns:stixVocabs="http://stix.mitre.org/default_vocabularies-1"
|
|
xmlns:stix-ciqidentity="http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1"
|
|
xmlns:snortTM="http://stix.mitre.org/extensions/TestMechanism#Snort-1"
|
|
xmlns:stix="http://stix.mitre.org/stix-1"
|
|
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
|
xmlns:="https://rufus.citlab.utoronto.ca"
|
|
xmlns:xal="urn:oasis:names:tc:ciq:xal:3"
|
|
xmlns:xnl="urn:oasis:names:tc:ciq:xnl:3"
|
|
xmlns:xpil="urn:oasis:names:tc:ciq:xpil:3"
|
|
xsi:schemaLocation="
|
|
http://cybox.mitre.org/common-2 http://cybox.mitre.org/XMLSchema/common/2.1/cybox_common.xsd
|
|
http://cybox.mitre.org/cybox-2 http://cybox.mitre.org/XMLSchema/core/2.1/cybox_core.xsd
|
|
http://cybox.mitre.org/default_vocabularies-2 http://cybox.mitre.org/XMLSchema/default_vocabularies/2.1/cybox_default_vocabularies.xsd
|
|
http://cybox.mitre.org/objects#ASObject-1 http://cybox.mitre.org/XMLSchema/objects/AS/1.0/AS_Object.xsd
|
|
http://cybox.mitre.org/objects#AddressObject-2 http://cybox.mitre.org/XMLSchema/objects/Address/2.1/Address_Object.xsd
|
|
http://cybox.mitre.org/objects#DomainNameObject-1 http://cybox.mitre.org/XMLSchema/objects/Domain_Name/1.0/Domain_Name_Object.xsd
|
|
http://cybox.mitre.org/objects#EmailMessageObject-2 http://cybox.mitre.org/XMLSchema/objects/Email_Message/2.1/Email_Message_Object.xsd
|
|
http://cybox.mitre.org/objects#FileObject-2 http://cybox.mitre.org/XMLSchema/objects/File/2.1/File_Object.xsd
|
|
http://cybox.mitre.org/objects#HTTPSessionObject-2 http://cybox.mitre.org/XMLSchema/objects/HTTP_Session/2.1/HTTP_Session_Object.xsd
|
|
http://cybox.mitre.org/objects#HostnameObject-1 http://cybox.mitre.org/XMLSchema/objects/Hostname/1.0/Hostname_Object.xsd
|
|
http://cybox.mitre.org/objects#MutexObject-2 http://cybox.mitre.org/XMLSchema/objects/Mutex/2.1/Mutex_Object.xsd
|
|
http://cybox.mitre.org/objects#PipeObject-2 http://cybox.mitre.org/XMLSchema/objects/Pipe/2.1/Pipe_Object.xsd
|
|
http://cybox.mitre.org/objects#URIObject-2 http://cybox.mitre.org/XMLSchema/objects/URI/2.1/URI_Object.xsd
|
|
http://cybox.mitre.org/objects#WinRegistryKeyObject-2 http://cybox.mitre.org/XMLSchema/objects/Win_Registry_Key/2.1/Win_Registry_Key_Object.xsd
|
|
http://data-marking.mitre.org/Marking-1 http://stix.mitre.org/XMLSchema/data_marking/1.1.1/data_marking.xsd
|
|
http://data-marking.mitre.org/extensions/MarkingStructure#TLP-1 http://stix.mitre.org/XMLSchema/extensions/marking/tlp/1.1.1/tlp_marking.xsd
|
|
http://stix.mitre.org/ExploitTarget-1 http://stix.mitre.org/XMLSchema/exploit_target/1.1.1/exploit_target.xsd
|
|
http://stix.mitre.org/Incident-1 http://stix.mitre.org/XMLSchema/incident/1.1.1/incident.xsd
|
|
http://stix.mitre.org/Indicator-2 http://stix.mitre.org/XMLSchema/indicator/2.1.1/indicator.xsd
|
|
http://stix.mitre.org/TTP-1 http://stix.mitre.org/XMLSchema/ttp/1.1.1/ttp.xsd
|
|
http://stix.mitre.org/ThreatActor-1 http://stix.mitre.org/XMLSchema/threat_actor/1.1.1/threat_actor.xsd
|
|
http://stix.mitre.org/common-1 http://stix.mitre.org/XMLSchema/common/1.1.1/stix_common.xsd
|
|
http://stix.mitre.org/default_vocabularies-1 http://stix.mitre.org/XMLSchema/default_vocabularies/1.1.1/stix_default_vocabularies.xsd
|
|
http://stix.mitre.org/extensions/Identity#CIQIdentity3.0-1 http://stix.mitre.org/XMLSchema/extensions/identity/ciq_3.0/1.1.1/ciq_3.0_identity.xsd
|
|
http://stix.mitre.org/extensions/TestMechanism#Snort-1 http://stix.mitre.org/XMLSchema/extensions/test_mechanism/snort/1.1.1/snort_test_mechanism.xsd
|
|
http://stix.mitre.org/stix-1 http://stix.mitre.org/XMLSchema/core/1.1.1/stix_core.xsd
|
|
urn:oasis:names:tc:ciq:xal:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xAL.xsd
|
|
urn:oasis:names:tc:ciq:xnl:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xNL.xsd
|
|
urn:oasis:names:tc:ciq:xpil:3 http://stix.mitre.org/XMLSchema/external/oasis_ciq_3.0/xPIL.xsd" id=":Package-c2b4b6fc-b3a6-407c-b4dc-da81c5b00eec" version="1.1.1" timestamp="2016-11-10T20:57:45.659431+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Export from MISP</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:Related_Packages>
|
|
<stix:Related_Package>
|
|
<stix:Package id=":STIXPackage-581ba774-6db4-441c-b981-49798e96ca05" version="1.1.1" timestamp="2016-11-10T15:54:41+00:00">
|
|
<stix:STIX_Header>
|
|
<stix:Title>Tracking UP007 and SLServer Espionage Campaigns (MISP Event #2)</stix:Title>
|
|
<stix:Package_Intent xsi:type="stixVocabs:PackageIntentVocab-1.0">Threat Report</stix:Package_Intent>
|
|
</stix:STIX_Header>
|
|
<stix:TTPs>
|
|
<stix:TTP id=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'>
|
|
<ttp:Title>Payload type: UP007 (MISP Attribute #30)</ttp:Title>
|
|
<ttp:Behavior>
|
|
<ttp:Malware>
|
|
<ttp:Malware_Instance>
|
|
<ttp:Name>UP007</ttp:Name>
|
|
</ttp:Malware_Instance>
|
|
</ttp:Malware>
|
|
</ttp:Behavior>
|
|
</stix:TTP>
|
|
<stix:TTP id=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'>
|
|
<ttp:Title>Payload type: SLServer (MISP Attribute #52)</ttp:Title>
|
|
<ttp:Behavior>
|
|
<ttp:Malware>
|
|
<ttp:Malware_Instance>
|
|
<ttp:Name>SLServer</ttp:Name>
|
|
</ttp:Malware_Instance>
|
|
</ttp:Malware>
|
|
</ttp:Behavior>
|
|
</stix:TTP>
|
|
</stix:TTPs>
|
|
<stix:Incidents>
|
|
<stix:Incident id=":incident-581ba774-6db4-441c-b981-49798e96ca05" timestamp="2016-11-10T15:57:11+00:00" xsi:type='incident:IncidentType'>
|
|
<incident:Title>Tracking UP007 and SLServer Espionage Campaigns</incident:Title>
|
|
<incident:External_ID source="MISP Event">2</incident:External_ID>
|
|
<incident:Time>
|
|
<incident:Incident_Discovery precision="second">2016-04-18T00:00:00+00:00</incident:Incident_Discovery>
|
|
<incident:Incident_Reported precision="second">2016-11-10T15:57:11+00:00</incident:Incident_Reported>
|
|
</incident:Time>
|
|
<incident:Status xsi:type="stixVocabs:IncidentStatusVocab-1.0">Closed</incident:Status>
|
|
<incident:Related_Indicators>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba833-5f7c-40f0-b2d4-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: safetyssl.security-centers.com (MISP Attribute #45)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: safetyssl.security-centers.com (MISP Attribute #45)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba833-5f7c-40f0-b2d4-497a8e96ca05">
|
|
<cybox:Object id=":DomainName-581ba833-5f7c-40f0-b2d4-497a8e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">safetyssl.security-centers.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba833-2410-4a7c-a67f-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: computer.security-centers.com (MISP Attribute #46)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: computer.security-centers.com (MISP Attribute #46)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba833-2410-4a7c-a67f-497a8e96ca05">
|
|
<cybox:Object id=":DomainName-581ba833-2410-4a7c-a67f-497a8e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">computer.security-centers.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba833-6060-4ce6-b102-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: hkemail.f3322.org (MISP Attribute #47)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: hkemail.f3322.org (MISP Attribute #47)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba833-6060-4ce6-b102-497a8e96ca05">
|
|
<cybox:Object id=":DomainName-581ba833-6060-4ce6-b102-497a8e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">hkemail.f3322.org</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba833-71b8-4f00-b1f8-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: www.olinaodi.com (MISP Attribute #48)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: www.olinaodi.com (MISP Attribute #48)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba833-71b8-4f00-b1f8-497a8e96ca05">
|
|
<cybox:Object id=":DomainName-581ba833-71b8-4f00-b1f8-497a8e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">www.olinaodi.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba833-4eb8-4589-ad6e-497a8e96ca05" timestamp="2016-11-03T17:12:19+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: tenday.mysecondarydns.com (MISP Attribute #49)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Domain Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: tenday.mysecondarydns.com (MISP Attribute #49)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba833-4eb8-4589-ad6e-497a8e96ca05">
|
|
<cybox:Object id=":DomainName-581ba833-4eb8-4589-ad6e-497a8e96ca05">
|
|
<cybox:Properties xsi:type="DomainNameObj:DomainNameObjectType">
|
|
<DomainNameObj:Value condition="Equals">tenday.mysecondarydns.com</DomainNameObj:Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:12:19+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba849-3730-4528-a94e-49798e96ca05" timestamp="2016-11-10T15:54:41+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: 59.188.12.123 (MISP Attribute #50)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: 59.188.12.123 (MISP Attribute #50)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba849-3730-4528-a94e-49798e96ca05">
|
|
<cybox:Object id=":Address-581ba849-3730-4528-a94e-49798e96ca05">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
|
<AddressObj:Address_Value condition="Equals">59.188.12.123</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-10T15:54:41+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Network activity</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba849-a850-4cbf-a6b2-49798e96ca05" timestamp="2016-11-10T15:54:32+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Network activity: 210.61.12.153 (MISP Attribute #51)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">IP Watchlist</indicator:Type>
|
|
<indicator:Description>Network activity: 210.61.12.153 (MISP Attribute #51)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba849-a850-4cbf-a6b2-49798e96ca05">
|
|
<cybox:Object id=":Address-581ba849-a850-4cbf-a6b2-49798e96ca05">
|
|
<cybox:Properties xsi:type="AddressObj:AddressObjectType" category="ipv4-addr" is_source="false">
|
|
<AddressObj:Address_Value condition="Equals">210.61.12.153</AddressObj:Address_Value>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-10T15:54:32+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-d2a4-4dcb-b1b3-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: d579d7a42ff140952da57264614c37bc (MISP Attribute #31)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-d2a4-4dcb-b1b3-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-d2a4-4dcb-b1b3-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d579d7a42ff140952da57264614c37bc</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-1d18-4479-997f-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: d8becbd6f188e3fb2c4d23a2d36d137b (MISP Attribute #32)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-1d18-4479-997f-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-1d18-4479-997f-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d8becbd6f188e3fb2c4d23a2d36d137b</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-2ce0-4046-9865-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: 09ddd70517cb48a46d9f93644b29c72f (MISP Attribute #33)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-2ce0-4046-9865-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-2ce0-4046-9865-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">09ddd70517cb48a46d9f93644b29c72f</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-91f4-4e92-9164-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: f70b295c6a5121b918682310ce0c2165 (MISP Attribute #34)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-91f4-4e92-9164-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-91f4-4e92-9164-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">f70b295c6a5121b918682310ce0c2165</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-cf4c-42ae-b661-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: f80edbb0fcfe7cec17592f61a06e4df2 (MISP Attribute #35)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-cf4c-42ae-b661-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-cf4c-42ae-b661-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">f80edbb0fcfe7cec17592f61a06e4df2</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-8d0c-4716-90dc-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: d8ede9e6c3a1a30398b0b98130ee3b38 (MISP Attribute #36)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-8d0c-4716-90dc-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-8d0c-4716-90dc-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d8ede9e6c3a1a30398b0b98130ee3b38</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-5a08-4dff-a2d8-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: ce8ec932be16b69ffa06626b3b423395 (MISP Attribute #37)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-5a08-4dff-a2d8-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-5a08-4dff-a2d8-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">ce8ec932be16b69ffa06626b3b423395</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-0954-44a7-afce-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: 6a541de84074a2c4ff99eb43252d9030 (MISP Attribute #38)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-0954-44a7-afce-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-0954-44a7-afce-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">6a541de84074a2c4ff99eb43252d9030</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-c96c-4e46-bd92-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: e0eb981ad6be0bd16246d5d442028687 (MISP Attribute #39)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-c96c-4e46-bd92-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-c96c-4e46-bd92-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">e0eb981ad6be0bd16246d5d442028687</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-ad74-4d70-bc5a-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: 639c7239f40d95f677a99abb059e8338 (MISP Attribute #40)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-ad74-4d70-bc5a-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-ad74-4d70-bc5a-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">639c7239f40d95f677a99abb059e8338</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-9adc-4354-9b03-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: d07b2738840ce3419df651d3a0a3a246 (MISP Attribute #41)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-9adc-4354-9b03-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-9adc-4354-9b03-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">d07b2738840ce3419df651d3a0a3a246</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-8010-4c55-a7c9-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: 397021af7c0284c28db65297a6711235 (MISP Attribute #42)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-8010-4c55-a7c9-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-8010-4c55-a7c9-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">397021af7c0284c28db65297a6711235</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-4924-41de-9ce9-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: dc195d814ec16fe91690b7e949e696f6 (MISP Attribute #43)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-4924-41de-9ce9-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-4924-41de-9ce9-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">dc195d814ec16fe91690b7e949e696f6</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
<incident:Related_Indicator>
|
|
<stixCommon:Relationship>Payload delivery</stixCommon:Relationship>
|
|
<stixCommon:Indicator id=":indicator-581ba817-1620-457c-ae64-49798e96ca05" timestamp="2016-11-03T17:11:51+00:00" xsi:type='indicator:IndicatorType'>
|
|
<indicator:Title>Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44)</indicator:Title>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">Malware Artifacts</indicator:Type>
|
|
<indicator:Type xsi:type="stixVocabs:IndicatorTypeVocab-1.1">File Hash Watchlist</indicator:Type>
|
|
<indicator:Description>Payload delivery: cfcd2a90e87156e1a811f9c7b0051002 (MISP Attribute #44)</indicator:Description>
|
|
<indicator:Valid_Time_Position/>
|
|
<indicator:Observable id=":observable-581ba817-1620-457c-ae64-49798e96ca05">
|
|
<cybox:Object id=":File-581ba817-1620-457c-ae64-49798e96ca05">
|
|
<cybox:Properties xsi:type="FileObj:FileObjectType">
|
|
<FileObj:Hashes>
|
|
<cyboxCommon:Hash>
|
|
<cyboxCommon:Type condition="Equals" xsi:type="cyboxVocabs:HashNameVocab-1.0">MD5</cyboxCommon:Type>
|
|
<cyboxCommon:Simple_Hash_Value condition="Equals">cfcd2a90e87156e1a811f9c7b0051002</cyboxCommon:Simple_Hash_Value>
|
|
</cyboxCommon:Hash>
|
|
</FileObj:Hashes>
|
|
</cybox:Properties>
|
|
</cybox:Object>
|
|
</indicator:Observable>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Indicated_TTP>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</indicator:Indicated_TTP>
|
|
<indicator:Confidence timestamp="2016-11-03T17:11:51+00:00">
|
|
<stixCommon:Value xsi:type="stixVocabs:HighMediumLowVocab-1.0">High</stixCommon:Value>
|
|
<stixCommon:Description>Derived from MISP's IDS flag. If an attribute is marked for IDS exports, the confidence will be high, otherwise none</stixCommon:Description>
|
|
</indicator:Confidence>
|
|
</stixCommon:Indicator>
|
|
</incident:Related_Indicator>
|
|
</incident:Related_Indicators>
|
|
<incident:Leveraged_TTPs>
|
|
<incident:Leveraged_TTP>
|
|
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
|
<stixCommon:TTP idref=":ttp-581ba7b8-59f4-402f-95d9-497a8e96ca05" timestamp="2016-11-03T17:10:16+00:00" xsi:type='ttp:TTPType'/>
|
|
</incident:Leveraged_TTP>
|
|
<incident:Leveraged_TTP>
|
|
<stixCommon:Relationship>Payload type</stixCommon:Relationship>
|
|
<stixCommon:TTP idref=":ttp-581ba88c-c144-41d1-ad67-497a8e96ca05" timestamp="2016-11-03T17:13:48+00:00" xsi:type='ttp:TTPType'/>
|
|
</incident:Leveraged_TTP>
|
|
</incident:Leveraged_TTPs>
|
|
<incident:History>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">Event Threat Level: High</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: SOURCE:CITIZENLAB</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: DETECT</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">MISP Tag: PUBLISHED</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_file_set
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for service files loading UP007"
|
|
|
|
strings:
|
|
$file1 = "\\Microsoft\\Internet Explorer\\conhost.exe"
|
|
$file2 = "\\Microsoft\\Internet Explorer\\dll2.xor"
|
|
$file3 = "\\Microsoft\\Internet Explorer\\HOOK.DLL"
|
|
$file4 = "\\Microsoft\\Internet Explorer\\main.dll"
|
|
$file5 = "\\Microsoft\\Internet Explorer\\nvsvc.exe"
|
|
$file6 = "\\Microsoft\\Internet Explorer\\SBieDll.dll"
|
|
$file7 = "\\Microsoft\\Internet Explorer\\mon"
|
|
$file8 = "\\Microsoft\\Internet Explorer\\runas.exe"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
//Just a few of these as they differ
|
|
3 of ($file*)
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_registry_checks
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for registry keys checked for by the dropper"
|
|
|
|
strings:
|
|
$reg1 = "SOFTWARE\\360Safe\\Liveup"
|
|
$reg2 = "Software\\360safe"
|
|
$reg3 = "SOFTWARE\\kingsoft\\Antivirus"
|
|
$reg4 = "SOFTWARE\\Avira\\Avira Destop"
|
|
$reg5 = "SOFTWARE\\rising\\RAV"
|
|
$reg6 = "SOFTWARE\\JiangMin"
|
|
$reg7 = "SOFTWARE\\Micropoint\\Anti-Attack"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
all of ($reg*)
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule dubseven_dropper_dialog_remains
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for related dialog remnants. How rude."
|
|
|
|
strings:
|
|
$dia1 = "fuckMessageBox 1.0" wide
|
|
$dia2 = "Rundll 1.0" wide
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
any of them
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule maindll_mutex
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Matches on the maindll mutex"
|
|
|
|
strings:
|
|
$mutex = "h31415927tttt"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$mutex
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_dialog_remains
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for related dialog remnants."
|
|
|
|
strings:
|
|
$slserver = "SLServer" wide
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$slserver
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_mutex
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for the mutex."
|
|
|
|
strings:
|
|
$mutex = "M&GX^DSF&DA@F"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$mutex
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_command_and_control
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for the C2 server."
|
|
|
|
strings:
|
|
$c2 = "safetyssl.security-centers.com"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$c2
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_campaign_code
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for the related campaign code."
|
|
|
|
strings:
|
|
$campaign = "wthkdoc0106"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$campaign
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
<incident:History_Item>
|
|
<incident:Journal_Entry time_precision="second">!Not implemented attribute category/type combination caught! attribute[Artifacts dropped][yara]: rule SLServer_unknown_string
|
|
{
|
|
meta:
|
|
author = "Matt Brooks, @cmatthewbrooks"
|
|
desc = "Searches for a unique string."
|
|
|
|
strings:
|
|
$string = "test-b7fa835a39"
|
|
|
|
condition:
|
|
//MZ header
|
|
uint16(0) == 0x5A4D and
|
|
|
|
//PE signature
|
|
uint32(uint32(0x3C)) == 0x00004550 and
|
|
|
|
$string
|
|
}</incident:Journal_Entry>
|
|
</incident:History_Item>
|
|
</incident:History>
|
|
<incident:Information_Source>
|
|
<stixCommon:Identity>
|
|
<stixCommon:Name>citizenlab</stixCommon:Name>
|
|
</stixCommon:Identity>
|
|
<stixCommon:References>
|
|
<stixCommon:Reference>https://citizenlab.org/2016/04/between-hong-kong-and-burma/</stixCommon:Reference>
|
|
</stixCommon:References>
|
|
</incident:Information_Source>
|
|
<incident:Handling>
|
|
<marking:Marking>
|
|
<marking:Controlled_Structure>../../../descendant-or-self::node()</marking:Controlled_Structure>
|
|
<marking:Marking_Structure xsi:type='tlpMarking:TLPMarkingStructureType' color="GREEN"/>
|
|
</marking:Marking>
|
|
</incident:Handling>
|
|
</stix:Incident>
|
|
</stix:Incidents>
|
|
</stix:Package>
|
|
</stix:Related_Package>
|
|
</stix:Related_Packages>
|
|
</stix:STIX_Package>
|